# Top **URL:** https://discuss.elastic.co/top.md?page=224&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 225 --- ## [Unable to install elasticsearch on ubuntu](https://discuss.elastic.co/t/unable-to-install-elasticsearch-on-ubuntu/376565)
**Author:** [@remoteconn-7891](https://discuss.elastic.co/u/remoteconn-7891)\ **Replies:** 12\ **Last updated:** [March 31, 2025, 5:47am UTC](https://discuss.elastic.co/t/unable-to-install-elasticsearch-on-ubuntu/376565 "2025-03-31T05:47:06Z")
Hello, I'm back. So I'm on Ubuntu Desktop now and trying to install Elasticsearch on the local terminal. The problem, I get an error that says it can't find the package. Here is the error message I get (venv) corey-jam… --- ## [Issues with ELK](https://discuss.elastic.co/t/issues-with-elk/337326)
**Author:** [@pero](https://discuss.elastic.co/u/pero)\ **Replies:** 20\ **Last updated:** [July 6, 2023, 10:40am UTC](https://discuss.elastic.co/t/issues-with-elk/337326 "2023-07-06T10:40:38Z")
Hi All, I have the template siem\_alarm created in my kibana index pattern but i have this error "Error: No indices match pattern "siem\_alarms" at url/bundles/commons.bundle.js:3:1337196" Does anyone know what could be … --- ## [Standalone apm agent is asking for a local user account password](https://discuss.elastic.co/t/standalone-apm-agent-is-asking-for-a-local-user-account-password/272184)
**Author:** [@molsza](https://discuss.elastic.co/u/molsza)\ **Replies:** 9\ **Last updated:** [May 20, 2021, 8:24pm UTC](https://discuss.elastic.co/t/standalone-apm-agent-is-asking-for-a-local-user-account-password/272184 "2021-05-20T20:24:46Z")
OS RedHat OpenJdk 11 Version 1.23.0 CLI agent, when run is asking for password. It is possible to just hit enter or provide wrong password and it will do the job. But for what it is asking, even if I am try to run it a… --- ## [Elasticsearch on AWS + raspberry pi](https://discuss.elastic.co/t/elasticsearch-on-aws-raspberry-pi/257485)
**Author:** [@Ettore\_Ciarcia](https://discuss.elastic.co/u/Ettore_Ciarcia)\ **Replies:** 9\ **Last updated:** [December 6, 2020, 5:26pm UTC](https://discuss.elastic.co/t/elasticsearch-on-aws-raspberry-pi/257485 "2020-12-06T17:26:24Z")
Hello everyone. I intend to send the weather data collected by a raspberry pie on ec2 instances hosting elasticsearch to view the temperature graphs on kibana. My idea is to make a comparison between the internal temper… --- ## [There is no dateparsefailure in the tag,but it does not work](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923)
**Author:** [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Replies:** 9\ **Last updated:** [May 9, 2018, 2:59am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923 "2018-05-09T02:59:58Z")
i have a field named "time",the format is just like "2018/05/02:08:22:23" , so i used a date filter, and the format is like following: date { match =\> \["time","yyyy/MM/dd:HH:mm:ss"\] targer =\>"@timestamp" } there is … --- ## [Stopword functionality suppression](https://discuss.elastic.co/t/stopword-functionality-suppression/8646)
**Author:** [@John\_Ohno](https://discuss.elastic.co/u/John_Ohno)\ **Replies:** 10\ **Last updated:** [November 2, 2012, 3:57pm UTC](https://discuss.elastic.co/t/stopword-functionality-suppression/8646 "2012-11-02T15:57:30Z")
We are trying to make Elastic work under constraints inherited from an older system that didn't support stopwords. We tried setting the stopword list in JSON to a null string both at index creation time and at search… --- ## [Questions about memory usage](https://discuss.elastic.co/t/questions-about-memory-usage/4999)
**Author:** [@Diogo\_Figueiredo](https://discuss.elastic.co/u/Diogo_Figueiredo)\ **Replies:** 12\ **Last updated:** [August 6, 2011, 5:11pm UTC](https://discuss.elastic.co/t/questions-about-memory-usage/4999 "2011-08-06T17:11:02Z")
Hi, I am using ElasticSearch for a few months in a project. The simplicity and power it has is.. really amazing. On this project we are using a VPS to host a normal LAMP stack + ElasticSearch. The problem is t… --- ## [Elastic ILM issue](https://discuss.elastic.co/t/elastic-ilm-issue/269715)
**Author:** [@datama](https://discuss.elastic.co/u/datama)\ **Replies:** 9\ **Last updated:** [April 30, 2021, 6:41pm UTC](https://discuss.elastic.co/t/elastic-ilm-issue/269715 "2021-04-30T18:41:06Z")
Team, I have setup ILM for hot-warm architecture, getting "action \[indices:admin/aliases\] is unauthorized for API key id of user " error during warm phase. Please advice on how I could resolve, I tried to do a move an… --- ## [Fiebeat test output error (Java heap size)](https://discuss.elastic.co/t/fiebeat-test-output-error-java-heap-size/280483)
**Author:** [@Ahmed2021](https://discuss.elastic.co/u/Ahmed2021)\ **Replies:** 10\ **Last updated:** [August 23, 2021, 2:50am UTC](https://discuss.elastic.co/t/fiebeat-test-output-error-java-heap-size/280483 "2021-08-23T02:50:38Z")
Hi All Can anyone help one the below error ? the file beat fails the test and we unable to access the Wazuh's dashboard \[root@ELS01 conf\]# filebeat test output elasticsearch: http://1.1.1.1:9200... parse url... OK c… --- ## [Index rollover due to policy does not copy mapping](https://discuss.elastic.co/t/index-rollover-due-to-policy-does-not-copy-mapping/348932)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 15\ **Last updated:** [December 9, 2023, 3:18pm UTC](https://discuss.elastic.co/t/index-rollover-due-to-policy-does-not-copy-mapping/348932 "2023-12-09T15:18:39Z")
Hello, I have setup an index with a 'date' field in milliseconds (epoch\_millis), I did set this explicitly while creating the index. Then I attached a policy to rollover after x days. After x days, a new index is creat… --- ## [Filebeat modules](https://discuss.elastic.co/t/filebeat-modules/280852)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 13\ **Last updated:** [August 11, 2021, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-modules/280852 "2021-08-11T15:18:57Z")
I have, hopefully, a very simple question: We have filebeat (zeek module) running on SERVER A. Filebeat takes it to kafka where it is then pulled down by logstash. The zeek.conf file in logstash is completely barren. It… --- ## [Kibana does not start on Debian10](https://discuss.elastic.co/t/kibana-does-not-start-on-debian10/302108)
**Author:** [@ukt05](https://discuss.elastic.co/u/ukt05)\ **Replies:** 10\ **Last updated:** [April 12, 2022, 7:10am UTC](https://discuss.elastic.co/t/kibana-does-not-start-on-debian10/302108 "2022-04-12T07:10:16Z")
Hi, I am running Elasticsearch and Kibana on one machine with Debian 10 in a cluster. Elastichsearch runs properly but Kibana doesn't start. When I execute the command "journalctl -f -u kibana the following result is s… --- ## [Logstash XML file parsing - awkward Splitting event Problem](https://discuss.elastic.co/t/logstash-xml-file-parsing-awkward-splitting-event-problem/174906)
**Author:** [@NativAt](https://discuss.elastic.co/u/NativAt)\ **Replies:** 10\ **Last updated:** [April 3, 2019, 3:14pm UTC](https://discuss.elastic.co/t/logstash-xml-file-parsing-awkward-splitting-event-problem/174906 "2019-04-03T15:14:10Z")
I'm working with ELK 6.7.0 on docker with official images. This is my conf file: input { file { path =\> "/usr/share/logstash/logs/\*.xml" type =\> "xml" sincedb\_path =\> "/dev/null" codec =\> multiline { … --- ## [Observability Engineer 7.9 - Lab 5.4 unable to get petclinic-react to appear](https://discuss.elastic.co/t/observability-engineer-7-9-lab-5-4-unable-to-get-petclinic-react-to-appear/328661)
**Author:** [@deccman](https://discuss.elastic.co/u/deccman)\ **Replies:** 11\ **Last updated:** [April 27, 2023, 1:23pm UTC](https://discuss.elastic.co/t/observability-engineer-7-9-lab-5-4-unable-to-get-petclinic-react-to-appear/328661 "2023-04-27T13:23:37Z")
Course: Elastic Observability Engineer Version: 7.9 Question: I have not been successful with getting petclinic-react to appear in the list of Services in APM. I can get the other three services to appear fine in APM… --- ## [Vector tiles search not returning hits on geo\_shape fields](https://discuss.elastic.co/t/vector-tiles-search-not-returning-hits-on-geo-shape-fields/294926)
**Author:** [@henri.normak](https://discuss.elastic.co/u/henri.normak)\ **Replies:** 11\ **Last updated:** [January 21, 2022, 11:33am UTC](https://discuss.elastic.co/t/vector-tiles-search-not-returning-hits-on-geo-shape-fields/294926 "2022-01-21T11:33:28Z")
The index mapping being used is equivalent to this one (simplified): PUT locations { "mappings": { "properties": { "geoshape": { "type": "geo\_shape" } } } } There is a specific document … --- ## [Giving up on filebeat/elastic soon.. dashboards broken when rolling over index](https://discuss.elastic.co/t/giving-up-on-filebeat-elastic-soon-dashboards-broken-when-rolling-over-index/242869)
**Author:** [@Martin\_Norrsken](https://discuss.elastic.co/u/Martin_Norrsken)\ **Replies:** 9\ **Last updated:** [July 30, 2020, 8:04am UTC](https://discuss.elastic.co/t/giving-up-on-filebeat-elastic-soon-dashboards-broken-when-rolling-over-index/242869 "2020-07-30T08:04:29Z")
I've set up elastic stack (7.8.0 now 7.8.1) in kubernetes and filebeat on my nodes. Everty time an index rolls over i get a lot of broken stuff. Every time i try to customize anything it breaks... Its so much that i susp… --- ## [Create Transactions from logs in .net](https://discuss.elastic.co/t/create-transactions-from-logs-in-net/226862)
**Author:** [@faizal](https://discuss.elastic.co/u/faizal)\ **Replies:** 9\ **Last updated:** [April 22, 2020, 5:21pm UTC](https://discuss.elastic.co/t/create-transactions-from-logs-in-net/226862 "2020-04-22T17:21:22Z")
Hello, I have a use case where we have logs generated in Azure blob from our deployments. Now we need to implement tracing for these requests. Since the architecture here is different we cannot directly add APM Library … --- ## [What is the best way to distribute nodes and shards in Elasticsearch to achieve fast search while storing recent data on SSD and older data on HDD?](https://discuss.elastic.co/t/what-is-the-best-way-to-distribute-nodes-and-shards-in-elasticsearch-to-achieve-fast-search-while-storing-recent-data-on-ssd-and-older-data-on-hdd/380988)
**Author:** [@Ella\_conan](https://discuss.elastic.co/u/Ella_conan)\ **Replies:** 27\ **Last updated:** [August 17, 2025, 7:52pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-distribute-nodes-and-shards-in-elasticsearch-to-achieve-fast-search-while-storing-recent-data-on-ssd-and-older-data-on-hdd/380988 "2025-08-17T19:52:12Z")
Hello, I am storing events from different sources, and the data is continuous and reaches huge sizes. I want to implement an effective strategy for data retention. I want to keep the last 14 days of data on SSD storage… --- ## [ElasticSearch Benchmark](https://discuss.elastic.co/t/elasticsearch-benchmark/16920)
**Author:** [@Jianjun\_Hu](https://discuss.elastic.co/u/Jianjun_Hu)\ **Replies:** 10\ **Last updated:** [April 11, 2014, 1:06pm UTC](https://discuss.elastic.co/t/elasticsearch-benchmark/16920 "2014-04-11T13:06:02Z")
Hi all, How to do benchmark of the ElasticSearch? Thanks! Best, Jianjun -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and … --- ## [What is meant by Heap in relation to ES?](https://discuss.elastic.co/t/what-is-meant-by-heap-in-relation-to-es/223031)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 9\ **Last updated:** [March 13, 2020, 6:37am UTC](https://discuss.elastic.co/t/what-is-meant-by-heap-in-relation-to-es/223031 "2020-03-13T06:37:07Z")
Consider the following situation: the node has 100 GB of RAM, but the ES heap size is 30 GB. Does this mean that ES will only ever use 30 GB of RAM? And the other 70 GB will go unused? If not, than what how does it use… --- ## [Double processor in ingest pipeline](https://discuss.elastic.co/t/double-processor-in-ingest-pipeline/371768)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 30\ **Last updated:** [December 17, 2024, 3:24pm UTC](https://discuss.elastic.co/t/double-processor-in-ingest-pipeline/371768 "2024-12-17T15:24:28Z")
Hi all, it is possible to create a custom ingest pipeline associated with an integration and a specific Data Stream with 2 processors. The second one should process a field created by the first one. --- ## [0.90.2 Memory bug](https://discuss.elastic.co/t/0-90-2-memory-bug/13664)
**Author:** [@Alexis\_Okuwa](https://discuss.elastic.co/u/Alexis_Okuwa)\ **Replies:** 13\ **Last updated:** [September 26, 2013, 5:44pm UTC](https://discuss.elastic.co/t/0-90-2-memory-bug/13664 "2013-09-26T17:44:03Z")
Having a werid issue where elasticsearch is using a lot of memory. I have the jvm settings to not use more then 1g but its using about 7gb of memory. Linux is reporting it using about 1g as it should be. But when i k… --- ## [No Compatible Fields: The "blabla" index pattern does not contain any of the following field types: geo\_point](https://discuss.elastic.co/t/no-compatible-fields-the-blabla-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/199855)
**Author:** [@Barushka](https://discuss.elastic.co/u/Barushka)\ **Replies:** 9\ **Last updated:** [September 24, 2019, 6:10pm UTC](https://discuss.elastic.co/t/no-compatible-fields-the-blabla-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/199855 "2019-09-24T18:10:26Z")
Hello everyone, I am new in ELK community. I have recently discovered ELK and currently going through a massive learning process. I encountered one issue that I cannot resolve. Please help! I am trying to visualize some… --- ## [Date filter problem](https://discuss.elastic.co/t/date-filter-problem/97211)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 10\ **Last updated:** [August 16, 2017, 10:25am UTC](https://discuss.elastic.co/t/date-filter-problem/97211 "2017-08-16T10:25:29Z")
1 : In kibana Time field is showing string , not as date field. 2 : this is my sample log file… {“Metrics”:“type=COUNTER, name=FacilityMgmtResource Counter, count=0,Time:2017-08-16\_01:51:14.926”} {“Metrics”:“type… --- ## [Attempt to index a large dataset fails](https://discuss.elastic.co/t/attempt-to-index-a-large-dataset-fails/10635)
**Author:** [@shlomivaknin](https://discuss.elastic.co/u/shlomivaknin)\ **Replies:** 11\ **Last updated:** [February 19, 2013, 2:57pm UTC](https://discuss.elastic.co/t/attempt-to-index-a-large-dataset-fails/10635 "2013-02-19T14:57:35Z")
Hey, We are attempting to index about 32gb of raw data, using ES 0.20.4 and sun java 1.6.0\_37, on a single node "cluster". After a while of bulk uploading (from the same node), we are getting Log4jESLogger.ja… --- ## [Get initial log from Logstash warning](https://discuss.elastic.co/t/get-initial-log-from-logstash-warning/304796)
**Author:** [@arazdolski](https://discuss.elastic.co/u/arazdolski)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 3:37pm UTC](https://discuss.elastic.co/t/get-initial-log-from-logstash-warning/304796 "2022-05-17T15:37:05Z")
Hi, I have a rsyslog -\> logstash -\> Elasticsearch setup and noticed a lot of warnings with tried to parse field \[v\] as an object, but found a concrete value in Logstash logs, but I cannot find the initial syslog which L… --- ## [Error message](https://discuss.elastic.co/t/error-message/358032)
**Author:** [@samsu](https://discuss.elastic.co/u/samsu)\ **Replies:** 9\ **Last updated:** [April 24, 2024, 7:27am UTC](https://discuss.elastic.co/t/error-message/358032 "2024-04-24T07:27:32Z")
I am encountering an issue with establishing a connection from Logstash to my local Elasticsearch instance. Each time I attempt to send data from Logstash to Elasticsearch, I receive the following error messages: \[logst… --- ## [Filebeat Parsing issue with module aws](https://discuss.elastic.co/t/filebeat-parsing-issue-with-module-aws/271374)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 9\ **Last updated:** [May 7, 2021, 10:36am UTC](https://discuss.elastic.co/t/filebeat-parsing-issue-with-module-aws/271374 "2021-05-07T10:36:29Z")
Hi, I had set up filebeat agent in my AWS account to ship logs from an S3 bucket. The s3 bucket contains Cloudtrail logs and VPC Flow Logs and has Access logging enabled. The file 'filebeat/modules.d/aws.yml' was modi… --- ## [Generated index with malformed mappings and ignores number of shards](https://discuss.elastic.co/t/generated-index-with-malformed-mappings-and-ignores-number-of-shards/236462)
**Author:** [@Hoda\_Shirzad](https://discuss.elastic.co/u/Hoda_Shirzad)\ **Replies:** 9\ **Last updated:** [June 10, 2020, 3:03pm UTC](https://discuss.elastic.co/t/generated-index-with-malformed-mappings-and-ignores-number-of-shards/236462 "2020-06-10T15:03:15Z")
Hello there, I am trying to move my indexing code from an old code base to a new one, the elasticsearch server that I am using is 6.6.0 and I have tried the following parameters for create index using the official php c… --- ## [Host Metrics not captured for centos7](https://discuss.elastic.co/t/host-metrics-not-captured-for-centos7/152875)
**Author:** [@Jas\_Ahluwalia](https://discuss.elastic.co/u/Jas_Ahluwalia)\ **Replies:** 9\ **Last updated:** [October 23, 2018, 10:48pm UTC](https://discuss.elastic.co/t/host-metrics-not-captured-for-centos7/152875 "2018-10-23T22:48:31Z")
Hi, I'm running metricbeat in a docker container. I'm unable to see the host's metrics in the dashboard (e.g. cpu usage, memory, etc.). Below is what i have in my docker compose file in terms of volume mounts and flags… --- ## [Is it possible to overwrite the select statement each time when db is called](https://discuss.elastic.co/t/is-it-possible-to-overwrite-the-select-statement-each-time-when-db-is-called/139086)
**Author:** [@Gokul\_15](https://discuss.elastic.co/u/Gokul_15)\ **Replies:** 9\ **Last updated:** [July 9, 2018, 7:47am UTC](https://discuss.elastic.co/t/is-it-possible-to-overwrite-the-select-statement-each-time-when-db-is-called/139086 "2018-07-09T07:47:30Z")
i have two dates, eg :(from)2018/01/01 to now ..i have to fetch the records between these two dates and after fetching from will be replaced with now timing and now with new timestamp..how can v do these?? any body??a… --- ## [Snapshot, Hot/Warm Architecture and Upgrade](https://discuss.elastic.co/t/snapshot-hot-warm-architecture-and-upgrade/344887)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 11\ **Last updated:** [October 13, 2023, 11:25am UTC](https://discuss.elastic.co/t/snapshot-hot-warm-architecture-and-upgrade/344887 "2023-10-13T11:25:36Z")
Hi there, I have a few questions here: First, if I have an index of 4.5 TB, what is the best way to back up that much data? Second, my existing cluster has 25 data nodes in total, if I want to apply hot/warm architect… --- ## [Elastic Search Data format conversion](https://discuss.elastic.co/t/elastic-search-data-format-conversion/154603)
**Author:** [@abhinav.dwivedi](https://discuss.elastic.co/u/abhinav.dwivedi)\ **Replies:** 10\ **Last updated:** [November 6, 2018, 9:11am UTC](https://discuss.elastic.co/t/elastic-search-data-format-conversion/154603 "2018-11-06T09:11:42Z")
Team I have 1 TB Elastic search data across 4 node cluster is there a way we can convert that data into CSV or Json? Regards Abhinav D --- ## [Nodes fail to join cluster - potential split brain scenario](https://discuss.elastic.co/t/nodes-fail-to-join-cluster-potential-split-brain-scenario/10889)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 10\ **Last updated:** [March 1, 2013, 5:32pm UTC](https://discuss.elastic.co/t/nodes-fail-to-join-cluster-potential-split-brain-scenario/10889 "2013-03-01T17:32:53Z")
8 node cluster running 0.20.0RC1, MINIMUM\_MASTER\_NODES is set to 5. At a certain point, 2 nodes (search7 and search8) left the cluster. The reason is unknown, it occurred while increasing the replica count on a new i… --- ## [Problem with elastic template in Logstash when indexing](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 12\ **Last updated:** [August 13, 2018, 6:15am UTC](https://discuss.elastic.co/t/problem-with-elastic-template-in-logstash-when-indexing/143751 "2018-08-13T06:15:32Z")
i have a working index in Logstash version 5.x but its not working in version 6.3.2 date fields are not reading as date. it's reading as keyword please help { "template" : "index\_i", "settings": { … --- ## [I would like to be able to search parenthsis](https://discuss.elastic.co/t/i-would-like-to-be-able-to-search-parenthsis/11576)
**Author:** [@Andy\_Bajka\_2](https://discuss.elastic.co/u/Andy_Bajka_2)\ **Replies:** 12\ **Last updated:** [April 15, 2013, 4:17pm UTC](https://discuss.elastic.co/t/i-would-like-to-be-able-to-search-parenthsis/11576 "2013-04-15T16:17:13Z")
I run a forum software called Xenforo and it uses ElasticSearch as a addon. It works great and I have enjoyed learning all about ES. What I would like to be able to do is search messages that contain parentheses. … --- ## [Logstash configuring error in windows](https://discuss.elastic.co/t/logstash-configuring-error-in-windows/232904)
**Author:** [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\ **Replies:** 9\ **Last updated:** [May 16, 2020, 10:02am UTC](https://discuss.elastic.co/t/logstash-configuring-error-in-windows/232904 "2020-05-16T10:02:37Z")
Hi, I am using elk stack to fetch logs from client machine. i have done using these version elasticsearch- 6.5.3 logstash- 6.5.3 after 6 months Today for testing i just started watching logs running elasticseach and logs… --- ## [Losgstash error starting with Expected one of #, {, ,, \] at line XX](https://discuss.elastic.co/t/losgstash-error-starting-with-expected-one-of-at-line-xx/179072)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 9\ **Last updated:** [April 30, 2019, 10:24pm UTC](https://discuss.elastic.co/t/losgstash-error-starting-with-expected-one-of-at-line-xx/179072 "2019-04-30T22:24:52Z")
I create a grok filter in order to capture this information with logstash from a syslog message The message of Syslog is like this "Logon Attempt";"4624";"Audit Success";"NetApp-Security-Auditing";"CIFS";"Security";"IT… --- ## [Removal of types in es 6](https://discuss.elastic.co/t/removal-of-types-in-es-6/133934)
**Author:** [@Ninad\_Pradhan](https://discuss.elastic.co/u/Ninad_Pradhan)\ **Replies:** 9\ **Last updated:** [June 5, 2018, 10:19pm UTC](https://discuss.elastic.co/t/removal-of-types-in-es-6/133934 "2018-06-05T22:19:13Z")
Am I the only one feeling that es keeps making these fundamental level changes affecting everyone? If they thought the analogy of tables and databases was a bad one, why did it take them like a thousand releases to know… --- ## [Search For a string in scripted index](https://discuss.elastic.co/t/search-for-a-string-in-scripted-index/264506)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/search-for-a-string-in-scripted-index/264506 "2021-02-22T01:19:25Z")
Hi, I need to search for a string in a field of an index using a scripted filed, below is how it looks like. build\_info.causes { "cause\_class": "some vaue", "short\_description": "Triggered by Gerrit: some value ." } … --- ## [Not able to create index patterns as kibana is not getting the indices](https://discuss.elastic.co/t/not-able-to-create-index-patterns-as-kibana-is-not-getting-the-indices/334565)
**Author:** [@kirankumarb](https://discuss.elastic.co/u/kirankumarb)\ **Replies:** 15\ **Last updated:** [June 5, 2023, 1:23am UTC](https://discuss.elastic.co/t/not-able-to-create-index-patterns-as-kibana-is-not-getting-the-indices/334565 "2023-06-05T01:23:30Z")
\-I am getting indices for most of services, but unable to get indices for few services. So I am unable to create index patterns. We are getting logs in servers but unable to see logs in Kibana dashboard. \_Filebeat is up… --- ## [Custom visualisation with Kibana](https://discuss.elastic.co/t/custom-visualisation-with-kibana/259876)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 10\ **Last updated:** [December 31, 2020, 7:42am UTC](https://discuss.elastic.co/t/custom-visualisation-with-kibana/259876 "2020-12-31T07:42:01Z")
Hello, I'm planning to use Kibana to display the worst screens displayed by users. I load the data from our transaction monitors in Elasticsearch using logstash. For each transaction, I have the duration of it loaded. … --- ## [Accumulate a ttl index into a large backup index](https://discuss.elastic.co/t/accumulate-a-ttl-index-into-a-large-backup-index/21635)
**Author:** [@Behrad\_Zari](https://discuss.elastic.co/u/Behrad_Zari)\ **Replies:** 10\ **Last updated:** [January 15, 2015, 6:43am UTC](https://discuss.elastic.co/t/accumulate-a-ttl-index-into-a-large-backup-index/21635 "2015-01-15T06:43:52Z")
My data contains a weekly ttl so my ES index will loose older data, however I want to have another accumulative large index containing a year of my data... How can I instruct ES/sync my second index without affecting… --- ## [Building a cluster for the first time](https://discuss.elastic.co/t/building-a-cluster-for-the-first-time/300322)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 9\ **Last updated:** [March 23, 2022, 2:54pm UTC](https://discuss.elastic.co/t/building-a-cluster-for-the-first-time/300322 "2022-03-23T14:54:01Z")
Hi All, So i'm trying to build a cluster for the first time, I've always been working in standalone mode, but i now need to step up into a cluster. So I have 3 instances setup and all are going to be master eligible. I… --- ## [Geo\_point not indexed in Array format](https://discuss.elastic.co/t/geo-point-not-indexed-in-array-format/229334)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 9\ **Last updated:** [April 27, 2020, 12:33pm UTC](https://discuss.elastic.co/t/geo-point-not-indexed-in-array-format/229334 "2020-04-27T12:33:07Z")
Hi all, I'm using logstash to index mongodb documents into ES. every thing goes well but the location object is not indexed. I defined a template mapping as geo\_point as follow : "arrival\_in": { "ignore\_m… --- ## [Elastic lib jars disappear and elasticsearch service stops working](https://discuss.elastic.co/t/elastic-lib-jars-disappear-and-elasticsearch-service-stops-working/187226)
**Author:** [@HPVRNP](https://discuss.elastic.co/u/HPVRNP)\ **Replies:** 9\ **Last updated:** [June 25, 2019, 1:12pm UTC](https://discuss.elastic.co/t/elastic-lib-jars-disappear-and-elasticsearch-service-stops-working/187226 "2019-06-25T13:12:32Z")
Hi, Whenever elasticsearch service dies with the following lines of logs, all the jar files inside lib folder gone missing. After this, the elasticsearch services stop working and not starting. Why do elasticsearch jar… --- ## [Certain rest requests time out](https://discuss.elastic.co/t/certain-rest-requests-time-out/11733)
**Author:** [@Boaz\_Leskes](https://discuss.elastic.co/u/Boaz_Leskes)\ **Replies:** 14\ **Last updated:** [May 21, 2013, 5:17pm UTC](https://discuss.elastic.co/t/certain-rest-requests-time-out/11733 "2013-05-21T17:17:12Z")
Hi, We are running a two node cluster where one of the nodes stopped responding consistently to REST requests. The following is going on: 1) On the problematic node: curl http://localhost:9200/\_cluster/health re… --- ## [What are the essential ecs items in elastic siem?](https://discuss.elastic.co/t/what-are-the-essential-ecs-items-in-elastic-siem/253509)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 10\ **Last updated:** [November 1, 2020, 4:52am UTC](https://discuss.elastic.co/t/what-are-the-essential-ecs-items-in-elastic-siem/253509 "2020-11-01T04:52:22Z")
I collected syslogs of security devices (WAF, IPS, IDS (suricata), anti-DDoS) by filebeat, delivered to logstash, and stacked them in elastisearch. I know that using filebeat, it automatically makes it into ecs format, … --- ## [Explain API - All these statistics are per shard not per index](https://discuss.elastic.co/t/explain-api-all-these-statistics-are-per-shard-not-per-index/230187)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 10\ **Last updated:** [April 29, 2020, 11:23am UTC](https://discuss.elastic.co/t/explain-api-all-these-statistics-are-per-shard-not-per-index/230187 "2020-04-29T11:23:34Z")
I am going through this thread Somewhere it is said All these statistics are per shard not per index I hope this statement is still valid , and i confirmed this behavior too .. What was the reasoning behind this … --- ## [Reindexing an index which had document added by ingest pipeline](https://discuss.elastic.co/t/reindexing-an-index-which-had-document-added-by-ingest-pipeline/337951)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 12\ **Last updated:** [July 9, 2023, 8:02pm UTC](https://discuss.elastic.co/t/reindexing-an-index-which-had-document-added-by-ingest-pipeline/337951 "2023-07-09T20:02:52Z")
I have an index my-idx-09-2022. I made a ingest pipeline so that all the updates from now of my-idx-09-2022 will go to a new index i.e my-idx-new-09-2023. Python code: def create\_write\_redirect\_pipeline(source\_client, … [Previous page](https://discuss.elastic.co/top.md?page=223&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=225&per_page=50&period=all)