# Top **URL:** https://discuss.elastic.co/top.md?page=242&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 243 --- ## [Want to exclude lines in file having "etluser" keyword](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850)
**Author:** [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Replies:** 9\ **Last updated:** [September 29, 2021, 11:55am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850 "2021-09-29T11:55:49Z")
hello team, we want to exclude lines in file having "etluser" keyword. we added this in yml file . Is this correct way to achieve the goal or any other way ? exclude\_lines: \['etluser'\] we have multiple filepath added … --- ## [ClientTimeout while awaiting headers](https://discuss.elastic.co/t/clienttimeout-while-awaiting-headers/383330)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 16\ **Last updated:** [November 12, 2025, 2:59pm UTC](https://discuss.elastic.co/t/clienttimeout-while-awaiting-headers/383330 "2025-11-12T14:59:45Z")
Hi Team, I want to monitor one url https://abccc.com/acbs. I am using http ping method . But i am getting \`Could not connect xx.xx.xx.xx:443 with error:dial tcp xx.xx.xx.xx:443:i/o timeout(Client.Timeout exceeds while … --- ## [Search for a field across multiple indices](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 9\ **Last updated:** [October 20, 2021, 5:28pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274 "2021-10-20T17:28:16Z")
Hi All, We have ELK 7.6.2 stack running with number of indices in place. One of the fields in the indices is called requestID which has a unique value e.g. 1-01-TV-PCVEFOW6JXMZSMEVUZBWXPWRFFMPEIG10411767701@1-21506255#… --- ## [Pre-built Dashboards Not Loading for Users Except Superuser](https://discuss.elastic.co/t/pre-built-dashboards-not-loading-for-users-except-superuser/344642)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 10\ **Last updated:** [October 10, 2023, 1:26pm UTC](https://discuss.elastic.co/t/pre-built-dashboards-not-loading-for-users-except-superuser/344642 "2023-10-10T13:26:50Z")
I have encountered an issue with certain pre-built dashboards in our system. These dashboards are failing to load for any users except the superuser. I have verified that all the required permissions are correctly assign… --- ## [Columns exported from Tabular CSV are reshuffled](https://discuss.elastic.co/t/columns-exported-from-tabular-csv-are-reshuffled/340921)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 10\ **Last updated:** [August 24, 2023, 7:05am UTC](https://discuss.elastic.co/t/columns-exported-from-tabular-csv-are-reshuffled/340921 "2023-08-24T07:05:37Z")
Hello Team, Columns are getting reshuflled when exported to CSV format When exported in CSV, columns are getting shifted Please can you help me for how to resolve this one --- ## [Restore snapshot index](https://discuss.elastic.co/t/restore-snapshot-index/321525)
**Author:** [@Arunadevi](https://discuss.elastic.co/u/Arunadevi)\ **Replies:** 9\ **Last updated:** [December 20, 2022, 5:08am UTC](https://discuss.elastic.co/t/restore-snapshot-index/321525 "2022-12-20T05:08:47Z")
While restoring an index , it requires either index closure or deleting the index. Is there any method to enable read while restoring the index. without causing an outage in search ? --- ## [Moving indices from Hot tier to Cold does not reduce hot tier size](https://discuss.elastic.co/t/moving-indices-from-hot-tier-to-cold-does-not-reduce-hot-tier-size/373001)
**Author:** [@Oolong](https://discuss.elastic.co/u/Oolong)\ **Replies:** 16\ **Last updated:** [January 10, 2025, 6:28pm UTC](https://discuss.elastic.co/t/moving-indices-from-hot-tier-to-cold-does-not-reduce-hot-tier-size/373001 "2025-01-10T18:28:47Z")
Hi Everyone, I have 200GB storage for HOT tier and 500GB for cold. I have so far used up 150GB on the HOT tier and have moved the indices that make up that 150 to Cold tier. My problem is that the Cold tier has increase… --- ## [Grok isn't getting parsed (grok debugger is parsing it fine but it's throwing error in logstash)](https://discuss.elastic.co/t/grok-isnt-getting-parsed-grok-debugger-is-parsing-it-fine-but-its-throwing-error-in-logstash/347706)
**Author:** [@sudhir\_singh](https://discuss.elastic.co/u/sudhir_singh)\ **Replies:** 10\ **Last updated:** [November 22, 2023, 3:06pm UTC](https://discuss.elastic.co/t/grok-isnt-getting-parsed-grok-debugger-is-parsing-it-fine-but-its-throwing-error-in-logstash/347706 "2023-11-22T15:06:46Z")
\- "22/Nov/2023:12:21:04 +0530" 196.24.23.101 GET "GET /api/status HTTP/1.1" 191 200 439 83 - "nginx/1.23.4 (health check server\_103.225.61.177\_Pool-1\_http\_ok)" 127.0.0.1:8080 200 0.002 0.002 0.000 0.002 - pauth.mumbcms.… --- ## [Port configured for logstash does not turn up (5044)](https://discuss.elastic.co/t/port-configured-for-logstash-does-not-turn-up-5044/344213)
**Author:** [@Manula\_Manjitha](https://discuss.elastic.co/u/Manula_Manjitha)\ **Replies:** 13\ **Last updated:** [October 3, 2023, 8:11am UTC](https://discuss.elastic.co/t/port-configured-for-logstash-does-not-turn-up-5044/344213 "2023-10-03T08:11:14Z")
I have configured a logstash on my server and the configurations in /etc/logstash/conf.d/beats.conf file are as follows. input { beats { port =\> 5044 host =\> "192.168.14.189" } } filter { if \[type\] =="sy… --- ## [Is there a way to export \_ttl from docs?](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 9\ **Last updated:** [May 21, 2021, 10:49am UTC](https://discuss.elastic.co/t/is-there-a-way-to-export-ttl-from-docs/273028 "2021-05-21T10:49:09Z")
Hey there, if \_ttl expiration value is configured within the documents of an index, is there a way to export/reindex those documents with the \_ttl value of that moment? For instance, using Logstash elasticsearch input … --- ## [Elasticsearch 8.12 Error when tryng to generate a report using curl and an URL given by Discovery tool](https://discuss.elastic.co/t/elasticsearch-8-12-error-when-tryng-to-generate-a-report-using-curl-and-an-url-given-by-discovery-tool/358734)
**Author:** [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Replies:** 13\ **Last updated:** [May 7, 2024, 12:42am UTC](https://discuss.elastic.co/t/elasticsearch-8-12-error-when-tryng-to-generate-a-report-using-curl-and-an-url-given-by-discovery-tool/358734 "2024-05-07T00:42:32Z")
Hi guys. I am tryng to generate a csv report using the following command curl -uelastic:xxxxxx -X POST \\ \> -H "kbn-xsrf: true" \\ "from": "now-12h" }, \> -H "Content-Type: application/json" \\ --cacert… --- ## [Problem with distributing tracing for Jakarta 10 and payara 6](https://discuss.elastic.co/t/problem-with-distributing-tracing-for-jakarta-10-and-payara-6/372920)
**Author:** [@ciment](https://discuss.elastic.co/u/ciment)\ **Replies:** 10\ **Last updated:** [February 5, 2026, 9:52am UTC](https://discuss.elastic.co/t/problem-with-distributing-tracing-for-jakarta-10-and-payara-6/372920 "2026-02-05T09:52:54Z")
Hi, I have a problem with distributing tracing after migration of my application (few microservices) from Payara 5.201 to 6.2024.12. During migration we have already updated application to Jakarta 10 (previous Java EE 8… --- ## [After the ElasticEndpoint enables full disk access, it is closed after a period of time](https://discuss.elastic.co/t/after-the-elasticendpoint-enables-full-disk-access-it-is-closed-after-a-period-of-time/354243)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 10\ **Last updated:** [April 3, 2024, 2:01am UTC](https://discuss.elastic.co/t/after-the-elasticendpoint-enables-full-disk-access-it-is-closed-after-a-period-of-time/354243 "2024-04-03T02:01:25Z")
Elastic agent version: 8.9.1 Mac versions: 14.0, 14.1 Problem Description: After installing the Elatic Agent, full disk access was enabled, and the logs were all normal. However, after running for 1-2 days, the full d… --- ## [ElasticCloud rollover](https://discuss.elastic.co/t/elasticcloud-rollover/271939)
**Author:** [@mfa](https://discuss.elastic.co/u/mfa)\ **Replies:** 9\ **Last updated:** [May 12, 2021, 11:36pm UTC](https://discuss.elastic.co/t/elasticcloud-rollover/271939 "2021-05-12T23:36:56Z")
I have sat up lifecycle policy for index in order to delete the index if it gets over 50 gb. The index is called: myindex-000001 and when the policy applies, it creates the second index which calls it: myindex-000002 aut… --- ## [Encountering \_geoip\_lookup\_failure within the IP address range 104.16.16.0/20](https://discuss.elastic.co/t/encountering-geoip-lookup-failure-within-the-ip-address-range-104-16-16-0-20/354958)
**Author:** [@yogeshk04](https://discuss.elastic.co/u/yogeshk04)\ **Replies:** 12\ **Last updated:** [March 10, 2024, 9:55am UTC](https://discuss.elastic.co/t/encountering-geoip-lookup-failure-within-the-ip-address-range-104-16-16-0-20/354958 "2024-03-10T09:55:55Z")
Could someone clarify why I consistently encounter the tags in my logstash pipeline "\_geoip\_lookup\_failure" issue with the IP address range 104.16.16.0/20, despite it working fine for other public IP addresses? --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/303178)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 9\ **Last updated:** [April 26, 2022, 9:33am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/303178 "2022-04-26T09:33:25Z")
Hello , i depoyed a multi node cluster with 3 azure vm, the cluster worked on ES and nodes are connected. but i can't work on them with kibana " Kibana server is not ready yet " --- ## [Elastic APM using Java agent : Only a subset of my incoming requests have spans, while the majority of requests do not](https://discuss.elastic.co/t/elastic-apm-using-java-agent-only-a-subset-of-my-incoming-requests-have-spans-while-the-majority-of-requests-do-not/343872)
**Author:** [@Hanok\_Jacob](https://discuss.elastic.co/u/Hanok_Jacob)\ **Replies:** 9\ **Last updated:** [September 29, 2023, 1:02pm UTC](https://discuss.elastic.co/t/elastic-apm-using-java-agent-only-a-subset-of-my-incoming-requests-have-spans-while-the-majority-of-requests-do-not/343872 "2023-09-29T13:02:26Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [List all entries matching a query](https://discuss.elastic.co/t/list-all-entries-matching-a-query/3332)
**Author:** [@sezgin\_kucukkaraasla](https://discuss.elastic.co/u/sezgin_kucukkaraasla)\ **Replies:** 9\ **Last updated:** [September 15, 2010, 10:42am UTC](https://discuss.elastic.co/t/list-all-entries-matching-a-query/3332 "2010-09-15T10:42:47Z")
Is there a way to list all entries matching a query, without providing the size parameter, because we don't know the actual size beforehand ? Sezgin Kucukkaraaslan www.ifountain.com --- ## [Logstash “bad\_certificate” Handshake Failure on port 5055](https://discuss.elastic.co/t/logstash-bad-certificate-handshake-failure-on-port-5055/379950)
**Author:** [@RyanW](https://discuss.elastic.co/u/RyanW)\ **Replies:** 13\ **Last updated:** [July 9, 2025, 7:00pm UTC](https://discuss.elastic.co/t/logstash-bad-certificate-handshake-failure-on-port-5055/379950 "2025-07-09T19:00:39Z")
Environment Item Version / Detail Security Onion 2.4.160 Host role so-manager (10.10.0.13) Standalone Network install on Rocky Linux 9 Elastic Agent endpoint Windows host winwork01 (10.10.0.4) Beats/Elastic… --- ## [If translog durability is set to request, then flush is required?](https://discuss.elastic.co/t/if-translog-durability-is-set-to-request-then-flush-is-required/358687)
**Author:** [@Amit\_Shukla](https://discuss.elastic.co/u/Amit_Shukla)\ **Replies:** 13\ **Last updated:** [May 5, 2024, 6:48am UTC](https://discuss.elastic.co/t/if-translog-durability-is-set-to-request-then-flush-is-required/358687 "2024-05-05T06:48:26Z")
Talking about Elasticsearch version 7.17 This is regarding how flush API and index.translog.durability settings are connected to each other. My understanding is that if this index.translog.durability is set as Request … --- ## [ELK, Problem with kibana](https://discuss.elastic.co/t/elk-problem-with-kibana/228279)
**Author:** [@ilhem](https://discuss.elastic.co/u/ilhem)\ **Replies:** 9\ **Last updated:** [April 16, 2020, 9:32pm UTC](https://discuss.elastic.co/t/elk-problem-with-kibana/228279 "2020-04-16T21:32:43Z")
I started using ELK, I liked it but I have a problem. actually i used logstash to analyze my log files and kibana to visualize it as a curve (a surface curve), it was great but the problem was I want to do my work automa… --- ## [Enable APM for springboot running on windows](https://discuss.elastic.co/t/enable-apm-for-springboot-running-on-windows/383568)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 20\ **Last updated:** [November 26, 2025, 2:56pm UTC](https://discuss.elastic.co/t/enable-apm-for-springboot-running-on-windows/383568 "2025-11-26T14:56:31Z")
Hello , I want to enable APM for java application running on tomcat server(windows). I’ve followed the steps mentioned in the setup-tomcat-windows . I have restarted the tomcat service running on windows but it was not … --- ## [Unble to convert to date string field](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661)
**Author:** [@casquero](https://discuss.elastic.co/u/casquero)\ **Replies:** 10\ **Last updated:** [June 22, 2021, 6:30pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661 "2021-06-22T18:30:09Z")
I've tried to create a new field as date but always appears as string in Kibana, I've done the following: mutate { add\_field =\> { "timestampTest" =\> "%{localisodate}" } } date { match =\> \["timest… --- ## [Random search errors from one node of three on a previously working cluster](https://discuss.elastic.co/t/random-search-errors-from-one-node-of-three-on-a-previously-working-cluster/4788)
**Author:** [@ian\_clark](https://discuss.elastic.co/u/ian_clark)\ **Replies:** 9\ **Last updated:** [July 8, 2011, 8:46pm UTC](https://discuss.elastic.co/t/random-search-errors-from-one-node-of-three-on-a-previously-working-cluster/4788 "2011-07-08T20:46:59Z")
Hi, I'm getting some random errors that started happening today. This is one error:- {"error":"ReduceSearchPhaseException\[Failed to execute phase \[fetch\], \[reduce\] \]; nested: ArrayIndexOutOfBoundsException\[1\]; ",… --- ## [After upgrading from ES 7, it is easy for a node to be unable to join the cluster for a long time after leaving. Restart the problem node and join it immediately](https://discuss.elastic.co/t/after-upgrading-from-es-7-it-is-easy-for-a-node-to-be-unable-to-join-the-cluster-for-a-long-time-after-leaving-restart-the-problem-node-and-join-it-immediately/373546)
**Author:** [@zcola](https://discuss.elastic.co/u/zcola)\ **Replies:** 14\ **Last updated:** [July 7, 2025, 7:52am UTC](https://discuss.elastic.co/t/after-upgrading-from-es-7-it-is-easy-for-a-node-to-be-unable-to-join-the-cluster-for-a-long-time-after-leaving-restart-the-problem-node-and-join-it-immediately/373546 "2025-07-07T07:52:47Z")
Versions 8.8.2 or 8.13.2 have this problem. The cluster data size is usually 300-700 tb. The log will be stuck in waiting for local cluster applier for more than ten minutes or one or two minutes. When you restart the p… --- ## [Csp error for custom kibana login page](https://discuss.elastic.co/t/csp-error-for-custom-kibana-login-page/348701)
**Author:** [@Karan\_Lobo](https://discuss.elastic.co/u/Karan_Lobo)\ **Replies:** 9\ **Last updated:** [January 5, 2024, 11:42am UTC](https://discuss.elastic.co/t/csp-error-for-custom-kibana-login-page/348701 "2024-01-05T11:42:28Z")
heeyy i am using a custom plugin for my kibana that changes the login page to give a custom look but i am getting an errror relating to csp --- ## [How to get a local ES to do an async copy over (replicate-over) of Prod ES indices?](https://discuss.elastic.co/t/how-to-get-a-local-es-to-do-an-async-copy-over-replicate-over-of-prod-es-indices/7018)
**Author:** [@pulkitsinghal](https://discuss.elastic.co/u/pulkitsinghal)\ **Replies:** 9\ **Last updated:** [March 17, 2012, 10:24am UTC](https://discuss.elastic.co/t/how-to-get-a-local-es-to-do-an-async-copy-over-replicate-over-of-prod-es-indices/7018 "2012-03-17T10:24:25Z")
I know that it is possible to start the index without any replicas, and add them at a later point: http://www.elasticsearch.org/guide/reference/api/admin-indices-update-settings.html But doing so in the simplest mann… --- ## [Memcached in logstash](https://discuss.elastic.co/t/memcached-in-logstash/355047)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [March 8, 2024, 11:11pm UTC](https://discuss.elastic.co/t/memcached-in-logstash/355047 "2024-03-08T23:11:08Z")
I have huge file that I am using in logstash with translate filter. But I think it is causing some issue as it misses some match for some event. By looking around I discover that memcached may be answer to that. but I … --- ## [Node reduction - Should I use "primaries" or "none"](https://discuss.elastic.co/t/node-reduction-should-i-use-primaries-or-none/375983)
**Author:** [@Archie1](https://discuss.elastic.co/u/Archie1)\ **Replies:** 10\ **Last updated:** [March 17, 2025, 9:34pm UTC](https://discuss.elastic.co/t/node-reduction-should-i-use-primaries-or-none/375983 "2025-03-17T21:34:33Z")
Hi Everyone, I am reducing an Elasticsearch cluster from 6 nodes to 3. I have already started the process and can see shard draining from the nodes. Nodes were taken out of the pool with the correct command so that pa… --- ## [File input plugin is treating the line as plain string eventhough the input is json](https://discuss.elastic.co/t/file-input-plugin-is-treating-the-line-as-plain-string-eventhough-the-input-is-json/330713)
**Author:** [@djrshn2346](https://discuss.elastic.co/u/djrshn2346)\ **Replies:** 10\ **Last updated:** [April 27, 2023, 12:48pm UTC](https://discuss.elastic.co/t/file-input-plugin-is-treating-the-line-as-plain-string-eventhough-the-input-is-json/330713 "2023-04-27T12:48:22Z")
File input plugin is treating the line as plain string eventhough the input is json. Output in Opensearch is : { "\_index" : "sample-logs-2023.04.24", "\_type" : "\_doc", "\_id" : "ui9PsocBICgSyzdw… --- ## [Debugging "Failed Documents" from Data Visualizer CSV Ingestion](https://discuss.elastic.co/t/debugging-failed-documents-from-data-visualizer-csv-ingestion/313112)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 10\ **Last updated:** [August 29, 2022, 3:22pm UTC](https://discuss.elastic.co/t/debugging-failed-documents-from-data-visualizer-csv-ingestion/313112 "2022-08-29T15:22:21Z")
I have a CSV file I'm trying to convert into an index via Kibana. I go to Machine Learning/Data Visualizer and upload my file. The "explanations" look good to me, as do all the guesses for the column types, so I hit "im… --- ## [Logstash is updating sincedb but indices are not creating](https://discuss.elastic.co/t/logstash-is-updating-sincedb-but-indices-are-not-creating/356516)
**Author:** [@Theivendram\_Athavan](https://discuss.elastic.co/u/Theivendram_Athavan)\ **Replies:** 12\ **Last updated:** [April 9, 2024, 12:01pm UTC](https://discuss.elastic.co/t/logstash-is-updating-sincedb-but-indices-are-not-creating/356516 "2024-04-09T12:01:08Z")
I am collecting ALB logs from S3 into elasticsearch using logstash. For now I wanted to collect more than one year of data from S3 and ingest into elasticsearch. I am creating indices for everyday with the name of index-… --- ## [Field level security and visualisations](https://discuss.elastic.co/t/field-level-security-and-visualisations/354826)
**Author:** [@mwitsas](https://discuss.elastic.co/u/mwitsas)\ **Replies:** 11\ **Last updated:** [March 7, 2024, 9:43am UTC](https://discuss.elastic.co/t/field-level-security-and-visualisations/354826 "2024-03-07T09:43:21Z")
We have implemented field level security to hide a sensitive field from a subset of users and this works as desired in discover etc. We had expected if a restricted user accesses a dashboard containing the field, the fi… --- ## [Failed to create fleet server elastic agent in Ubuntu](https://discuss.elastic.co/t/failed-to-create-fleet-server-elastic-agent-in-ubuntu/380713)
**Author:** [@Adib\_Aulia\_Rahmansya](https://discuss.elastic.co/u/Adib_Aulia_Rahmansya)\ **Replies:** 9\ **Last updated:** [August 6, 2025, 4:01am UTC](https://discuss.elastic.co/t/failed-to-create-fleet-server-elastic-agent-in-ubuntu/380713 "2025-08-06T04:01:12Z")
i have download the .tar.gz elastic agent version 9.1 after extract it, i got error when running the installation sudo ./elastic-agent install \\ --fleet-server-es=https://redacted \\ --fleet-server-service-token=red… --- ## [Migrate data](https://discuss.elastic.co/t/migrate-data/3110)
**Author:** [@David\_Jensen\_2](https://discuss.elastic.co/u/David_Jensen_2)\ **Replies:** 9\ **Last updated:** [July 17, 2010, 9:42am UTC](https://discuss.elastic.co/t/migrate-data/3110 "2010-07-17T09:42:24Z")
I currently am running 3 small instance EC2 nodes and I want to move to 2 large EC2 instances. What is the best way to migrate the data? I brought up a large EC2 instance already but if I shut down one of my small i… --- ## [Snapshot on s3 compatible cloud object storage](https://discuss.elastic.co/t/snapshot-on-s3-compatible-cloud-object-storage/374201)
**Author:** [@ragc007](https://discuss.elastic.co/u/ragc007)\ **Replies:** 13\ **Last updated:** [February 11, 2025, 11:01pm UTC](https://discuss.elastic.co/t/snapshot-on-s3-compatible-cloud-object-storage/374201 "2025-02-11T23:01:13Z")
receiving error : { "error": { "root\_cause": \[ { "type": "repository\_verification\_exception", "reason": "\[es\_repo\] path is not accessible on master node" … --- ## [Grok issues / Fingerprint issues: Value not imported into ES after 6.x - 7-x update](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357)
**Author:** [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)\ **Replies:** 9\ **Last updated:** [October 16, 2023, 8:48am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357 "2023-10-16T08:48:05Z")
Hello, I am new to ELK stack especially the filtering / Grok in Logstash, We are having issues importing DATA:servicename value into ES after moving from 6.3.X to a 7.14 version. The grok below is part of our applica… --- ## [Logstash Elasticsearch filter Bad URI Exception](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176)
**Author:** [@eraste](https://discuss.elastic.co/u/eraste)\ **Replies:** 9\ **Last updated:** [January 14, 2023, 7:02pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-bad-uri-exception/323176 "2023-01-14T19:02:12Z")
Hello Everyone. I have an exception in Logstash with Elasticsearch filter in the hosts parameter. When i give manually the hosts parameter like this, all thing is good, i don't get error : filter { elasticsearch {… --- ## [Gap in basic understanding of message processing of Logstash](https://discuss.elastic.co/t/gap-in-basic-understanding-of-message-processing-of-logstash/175980)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 9\ **Last updated:** [April 9, 2019, 12:36pm UTC](https://discuss.elastic.co/t/gap-in-basic-understanding-of-message-processing-of-logstash/175980 "2019-04-09T12:36:35Z")
Hi Guys, I did a quick training about Logstash on Udemy and I think i forgot about one important thing and didn't took a note. So I could use a brief explanation on what do I do wrong. Based on the message content, I w… --- ## [Elasticsearch deleting 10 days old index every day automatically](https://discuss.elastic.co/t/elasticsearch-deleting-10-days-old-index-every-day-automatically/380365)
**Author:** [@leo-lee](https://discuss.elastic.co/u/leo-lee)\ **Replies:** 21\ **Last updated:** [July 30, 2025, 2:36am UTC](https://discuss.elastic.co/t/elasticsearch-deleting-10-days-old-index-every-day-automatically/380365 "2025-07-30T02:36:13Z")
elasticsearch installed on aks, deleting 10 days old index automatically everyday at the same time. version: elasticsearch: 8.17.1 kibana: 8.17.1 current ilm policy is set to 30days warm, 180day delete. xpack.securi… --- ## [Trying to create a filter in Kibana, there is no proposal](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850)
**Author:** [@pchanas](https://discuss.elastic.co/u/pchanas)\ **Replies:** 14\ **Last updated:** [July 8, 2025, 11:33am UTC](https://discuss.elastic.co/t/trying-to-create-a-filter-in-kibana-there-is-no-proposal/379850 "2025-07-08T11:33:29Z")
Hi We have a 8.6.2 stack release. When creating a filter, either with the UI or with the text field, we don't have any proposal. This is occuring since we reinstall the stack on a other platform. Maybe we forgot t… --- ## [\[indices:admin/create\] is unauthorized for user Elastic Stack](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767)
**Author:** [@frahmn](https://discuss.elastic.co/u/frahmn)\ **Replies:** 17\ **Last updated:** [November 30, 2025, 9:19pm UTC](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767 "2025-11-30T21:19:30Z")
I have read through many articles and am not able to solve this issue for me. I’m trying to generate a new api key that has rights over creating indicies using filebeat. I have tried doing this through the superuser acco… --- ## [How does cluster.auto\_shrink\_voting\_configuration prevent split brain?](https://discuss.elastic.co/t/how-does-cluster-auto-shrink-voting-configuration-prevent-split-brain/342418)
**Author:** [@etki](https://discuss.elastic.co/u/etki)\ **Replies:** 9\ **Last updated:** [September 7, 2023, 11:31am UTC](https://discuss.elastic.co/t/how-does-cluster-auto-shrink-voting-configuration-prevent-split-brain/342418 "2023-09-07T11:31:15Z")
We have some docs telling that it's not possible, but they don't explain much, just stating some things. How is the following situation avoided? A cluster has voting configuration of 5 nodes. A network partition occurs… --- ## [Logstash config](https://discuss.elastic.co/t/logstash-config/333631)
**Author:** [@A1i](https://discuss.elastic.co/u/A1i)\ **Replies:** 9\ **Last updated:** [May 22, 2023, 4:28am UTC](https://discuss.elastic.co/t/logstash-config/333631 "2023-05-22T04:28:57Z")
how can I config logstash to read two log files from local then pass them into two indies --- ## [Input multiple files using Elastic Agent](https://discuss.elastic.co/t/input-multiple-files-using-elastic-agent/317150)
**Author:** [@shuuny-matrix](https://discuss.elastic.co/u/shuuny-matrix)\ **Replies:** 9\ **Last updated:** [October 25, 2022, 4:08pm UTC](https://discuss.elastic.co/t/input-multiple-files-using-elastic-agent/317150 "2022-10-25T16:08:38Z")
Hi, I wanted to input multiple files with same category from a directory to a same index into Kibana with Elasticsearch backend. I noticed that it could be done using Logstash but not clear documentation on how to do to… --- ## [Elasticsearch server](https://discuss.elastic.co/t/elasticsearch-server/6778)
**Author:** [@Abhishek\_Jajoria](https://discuss.elastic.co/u/Abhishek_Jajoria)\ **Replies:** 9\ **Last updated:** [February 27, 2012, 3:57pm UTC](https://discuss.elastic.co/t/elasticsearch-server/6778 "2012-02-27T15:57:08Z")
My elasticsearch server detects other clusters which are running in the same network similarly other server detects my cluster. How can I configure the elasticsearch.yml so that no other server can detect my cluster… --- ## [Elastic search performance issues](https://discuss.elastic.co/t/elastic-search-performance-issues/380368)
**Author:** [@prateekp](https://discuss.elastic.co/u/prateekp)\ **Replies:** 12\ **Last updated:** [July 26, 2025, 4:35am UTC](https://discuss.elastic.co/t/elastic-search-performance-issues/380368 "2025-07-26T04:35:39Z")
Hi team I have a production use case where i have small index few hundred megabutes like 10k docs. i have setup where i have many replicas and but single shard. The current bottleneck seems to be fetch phase of the que… --- ## [Convert the default ES UTC time to local timezone with logstash](https://discuss.elastic.co/t/convert-the-default-es-utc-time-to-local-timezone-with-logstash/361843)
**Author:** [@gbL2k](https://discuss.elastic.co/u/gbL2k)\ **Replies:** 11\ **Last updated:** [June 25, 2024, 2:11pm UTC](https://discuss.elastic.co/t/convert-the-default-es-utc-time-to-local-timezone-with-logstash/361843 "2024-06-25T14:11:10Z")
Hello everyone, My goal is export alerts from elasticsearch and I have 2 problems left to solve: My current configuration: input { elasticsearch { hosts =\> "https://ip:9200" index =\> ".internal.alerts-securi… --- ## [Did anything change concerning dashboards from version 6.3 to version 7.5?](https://discuss.elastic.co/t/did-anything-change-concerning-dashboards-from-version-6-3-to-version-7-5/338584)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 13\ **Last updated:** [August 6, 2023, 6:54pm UTC](https://discuss.elastic.co/t/did-anything-change-concerning-dashboards-from-version-6-3-to-version-7-5/338584 "2023-08-06T18:54:04Z")
Hello, Did anything change concerning dashboards from version 6.3 to version 7.5 ? I have a working dashboard in one environment with version 6.3, and the exactly same dashboard doesn't work from version 7.5. The dash… --- ## [Relevancy of Old article](https://discuss.elastic.co/t/relevancy-of-old-article/274622)
**Author:** [@sj123](https://discuss.elastic.co/u/sj123)\ **Replies:** 9\ **Last updated:** [June 4, 2021, 7:35am UTC](https://discuss.elastic.co/t/relevancy-of-old-article/274622 "2021-06-04T07:35:19Z")
Hi, I am quite new to elasticsearch. I have been reading this article Elasticsearch as a NoSQL Database | Elastic Blog\[Elasticsearch as a NoSQL Database\](https://Elasticsearch as a NoSQL Database). This was posted in 201… [Previous page](https://discuss.elastic.co/top.md?page=241&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=243&per_page=50&period=all)