# Top **URL:** https://discuss.elastic.co/top.md?page=244&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 245 --- ## [Xml parse in logstash](https://discuss.elastic.co/t/xml-parse-in-logstash/352853)
**Author:** [@Ayaan\_Shaik](https://discuss.elastic.co/u/Ayaan_Shaik)\ **Replies:** 9\ **Last updated:** [February 13, 2024, 4:12pm UTC](https://discuss.elastic.co/t/xml-parse-in-logstash/352853 "2024-02-13T16:12:16Z")
Hi @Badger I'm Trying to parse the log file with below xml \ **Author:** [@milank2](https://discuss.elastic.co/u/milank2)\ **Replies:** 9\ **Last updated:** [April 30, 2023, 10:56pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-indexes/331064 "2023-04-30T22:56:38Z") Hello everyone, I am new to ELK and the issue I am experiencing is that indexes are after 3 days reduces to 25x bytes and 0 documents. We are viewing index patterns in Kibana but it will display the 3 days only. Nothing… --- ## [Snapshot retention question](https://discuss.elastic.co/t/snapshot-retention-question/254677)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 9\ **Last updated:** [November 8, 2020, 4:40pm UTC](https://discuss.elastic.co/t/snapshot-retention-question/254677 "2020-11-08T16:40:58Z")
I'm new to ElasticSearch administration. From what I've gathered so far for snapshots is they are always incremental. My question is regarding snapshot retention. The documentation mentions that the snapshots can be c… --- ## [ES query help](https://discuss.elastic.co/t/es-query-help/13818)
**Author:** [@thale\_jacobs](https://discuss.elastic.co/u/thale_jacobs)\ **Replies:** 9\ **Last updated:** [October 15, 2013, 7:05pm UTC](https://discuss.elastic.co/t/es-query-help/13818 "2013-10-15T19:05:44Z")
Hello - I am fairly new to ES and need some help with a ES query. This is how I built my index: curl -XPOST 'http://127.0.0.1:9200/test/\*country\*?pretty=1' -d '{ "country": \["United States"\]}' curl -XPOST 'http… --- ## [Elasticsearch cluster with Docker vs Kubernetes](https://discuss.elastic.co/t/elasticsearch-cluster-with-docker-vs-kubernetes/375074)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [March 4, 2025, 8:34pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-with-docker-vs-kubernetes/375074 "2025-03-04T20:34:48Z")
Question regarding the upgrade of an Elasticsearch cluster, which has over 50 nodes, to a new cluster running RedHat operating system. The question is: should we build the new cluster in a Docker environment or a Kub… --- ## [Failed to handle event of type ERROR with this error: null](https://discuss.elastic.co/t/failed-to-handle-event-of-type-error-with-this-error-null/372908)
**Author:** [@Nicolae\_Nicora](https://discuss.elastic.co/u/Nicolae_Nicora)\ **Replies:** 14\ **Last updated:** [January 17, 2025, 10:32am UTC](https://discuss.elastic.co/t/failed-to-handle-event-of-type-error-with-this-error-null/372908 "2025-01-17T10:32:26Z")
Need you help on this null pointer exception! APM Agent used as layers to AWS Lambda: arn:aws:lambda:eu-west-1:267093732750:layer:elastic-apm-extension-ver-1-5-7-arm64:1 arn:aws:lambda:eu-west-1:267093732750:layer… --- ## [Conditional colouring using kibana dashboard](https://discuss.elastic.co/t/conditional-colouring-using-kibana-dashboard/379662)
**Author:** [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\ **Replies:** 10\ **Last updated:** [July 1, 2025, 1:11pm UTC](https://discuss.elastic.co/t/conditional-colouring-using-kibana-dashboard/379662 "2025-07-01T13:11:32Z")
Hello everyone! I have one dashboard to showing uptime monitor. It shows all ports for 2 different nodes. So 2 panels with name 'node 1' and 'node 2' and 2 tables for each (same but with filters for dedicated nodes). Ta… --- ## [Elastic serach going unresponsive](https://discuss.elastic.co/t/elastic-serach-going-unresponsive/354505)
**Author:** [@thenmozhi](https://discuss.elastic.co/u/thenmozhi)\ **Replies:** 12\ **Last updated:** [March 13, 2024, 4:45am UTC](https://discuss.elastic.co/t/elastic-serach-going-unresponsive/354505 "2024-03-13T04:45:57Z")
16GB RAM, 112 memory server with elastic 7.0.15 installed. when ever elastic running the website is going ideal --- ## [Metricbeat forcing to use manually created template](https://discuss.elastic.co/t/metricbeat-forcing-to-use-manually-created-template/362634)
**Author:** [@Ronaldo\_Lanhellas](https://discuss.elastic.co/u/Ronaldo_Lanhellas)\ **Replies:** 13\ **Last updated:** [July 6, 2024, 9:44pm UTC](https://discuss.elastic.co/t/metricbeat-forcing-to-use-manually-created-template/362634 "2024-07-06T21:44:34Z")
Hi Folks, I have an APIKey in my Elasticsearch which allows only index creation with specific patterns such as "app-abc-\*". It does not allow index template creations. The company has a default-template which is applied… --- ## [Data Table Equivalent to Display 200,000 rows of data](https://discuss.elastic.co/t/data-table-equivalent-to-display-200-000-rows-of-data/366951)
**Author:** [@ManiS](https://discuss.elastic.co/u/ManiS)\ **Replies:** 10\ **Last updated:** [September 30, 2024, 4:24am UTC](https://discuss.elastic.co/t/data-table-equivalent-to-display-200-000-rows-of-data/366951 "2024-09-30T04:24:57Z")
Hi all, I'm trying to create a Data Table visualization based on an Index that has around 200,000 rows of data. However, when the data table index tries to display the visualization, it is failing with the following err… --- ## [Any Reason traces-apm@template is using Standard Index mode instead of timeseries or logsdb](https://discuss.elastic.co/t/any-reason-traces-apm-template-is-using-standard-index-mode-instead-of-timeseries-or-logsdb/383301)
**Author:** [@Serak\_Shiferaw](https://discuss.elastic.co/u/Serak_Shiferaw)\ **Replies:** 10\ **Last updated:** [December 22, 2025, 8:51am UTC](https://discuss.elastic.co/t/any-reason-traces-apm-template-is-using-standard-index-mode-instead-of-timeseries-or-logsdb/383301 "2025-12-22T08:51:09Z")
we are capturing enterprise java traces, and the trace is filling up all the spaces on my cluster, its generating 1.4TB daily and i cant keep up, then upon checking there is no compression on the created index and its ju… --- ## [Common points in two geo\_bounding\_box](https://discuss.elastic.co/t/common-points-in-two-geo-bounding-box/324387)
**Author:** [@maya\_khan](https://discuss.elastic.co/u/maya_khan)\ **Replies:** 10\ **Last updated:** [February 2, 2023, 7:00am UTC](https://discuss.elastic.co/t/common-points-in-two-geo-bounding-box/324387 "2023-02-02T07:00:17Z")
I have two geo\_bounding\_box within these two shapes many points exist. i want only those points that are common in both geo\_bounding\_box. { "bool":{ "should":\[ { "geo\_bounding\_box":{ "geo\_coords":{ "top\_left": { … --- ## [Indexes cannot be referenced after cluster configuration](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 12\ **Last updated:** [July 19, 2022, 5:15am UTC](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970 "2022-07-19T05:15:08Z")
I am creating an Elasticsearch cluster. I am deleting the Elasticsearch node configuration that was already running on a single node and configuring a cluster with two newly created Elasticsearch nodes. Here, the clust… --- ## [Kibana unable to query index data from ES](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134)
**Author:** [@GregoryBrown](https://discuss.elastic.co/u/GregoryBrown)\ **Replies:** 10\ **Last updated:** [April 16, 2021, 1:14am UTC](https://discuss.elastic.co/t/kibana-unable-to-query-index-data-from-es/270134 "2021-04-16T01:14:36Z")
I am able to upload the following data into my ES Cluster, and have an index template apply to it. However the default search of kibana (using an index pattern) doesn't query the data. Index Template that gets applied t… --- ## [2 nodes logstash](https://discuss.elastic.co/t/2-nodes-logstash/320012)
**Author:** [@maxxl](https://discuss.elastic.co/u/maxxl)\ **Replies:** 9\ **Last updated:** [December 5, 2022, 6:26am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012 "2022-12-05T06:26:35Z")
1 logstash works fine 2 logstash, wrong view in kibana --- ## [Unable to perform airthmetic operations in ruby using logstash pipeline](https://discuss.elastic.co/t/unable-to-perform-airthmetic-operations-in-ruby-using-logstash-pipeline/329587)
**Author:** [@Sujith\_Nair](https://discuss.elastic.co/u/Sujith_Nair)\ **Replies:** 10\ **Last updated:** [April 9, 2023, 1:54pm UTC](https://discuss.elastic.co/t/unable-to-perform-airthmetic-operations-in-ruby-using-logstash-pipeline/329587 "2023-04-09T13:54:45Z")
Hi guys, I am facing an issue where i am trying to perform an airthmetic operation using ruby but in at the field section i am getting the same value not the subtracted value. event.set('\[d\]', (event.get('\[b\]').to\_f) -… --- ## [How to implement with complicate wording (hero hero hero)](https://discuss.elastic.co/t/how-to-implement-with-complicate-wording-hero-hero-hero/309722)
**Author:** [@Ch\_Corporate](https://discuss.elastic.co/u/Ch_Corporate)\ **Replies:** 10\ **Last updated:** [July 15, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-implement-with-complicate-wording-hero-hero-hero/309722 "2022-07-15T13:00:58Z")
My data is Doc 1 hero hero hero Doc 2 hero hero Doc 3 hero We would have Result is Doc 3:"hero" How do I implement this case use regular expression or wild card --- ## [java.nio.file.NoSuchFileException: /usr/share/elasticsearch/data/\_state/\_pu2t.cfs](https://discuss.elastic.co/t/java-nio-file-nosuchfileexception-usr-share-elasticsearch-data-state-pu2t-cfs/390250)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 15\ **Last updated:** [September 19, 2026, 6:07pm UTC](https://discuss.elastic.co/t/java-nio-file-nosuchfileexception-usr-share-elasticsearch-data-state-pu2t-cfs/390250 "2026-09-19T18:07:12Z")
Hi, I have a problem with one of my elasticsearch node. For some reason node was shutdown due to some error. When I look into the log, I get the error java.nio.file.NoSuchFileException: /usr/share/elasticsearch/data/\_st… --- ## [Three node cluster failes completely when one node shuts down](https://discuss.elastic.co/t/three-node-cluster-failes-completely-when-one-node-shuts-down/322638)
**Author:** [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Replies:** 9\ **Last updated:** [January 10, 2023, 4:36pm UTC](https://discuss.elastic.co/t/three-node-cluster-failes-completely-when-one-node-shuts-down/322638 "2023-01-10T16:36:01Z")
I have a three node cluster with Elastic 8.4.2. When all three nodes are up, it all appears fine. I built the cluster with a single node (audit1), but later added the other two nodes (audit2 & audit3). If I shutdown e… --- ## [Unexpected indices being created by Logstash](https://discuss.elastic.co/t/unexpected-indices-being-created-by-logstash/254230)
**Author:** [@Philip\_Colmer](https://discuss.elastic.co/u/Philip_Colmer)\ **Replies:** 9\ **Last updated:** [November 4, 2020, 10:36am UTC](https://discuss.elastic.co/t/unexpected-indices-being-created-by-logstash/254230 "2020-11-04T10:36:13Z")
I'm using Logstash to ingest logs stored on AWS S3. My configuration file looks like this: input { s3 { "access\_key\_id" =\> "REDACTED" "secret\_access\_key" =\> "REDACTED" … --- ## [Multisource index on elasticsearch passing by logstash](https://discuss.elastic.co/t/multisource-index-on-elasticsearch-passing-by-logstash/330844)
**Author:** [@Abdeljalil\_El\_Yousso](https://discuss.elastic.co/u/Abdeljalil_El_Yousso)\ **Replies:** 10\ **Last updated:** [April 28, 2023, 3:57pm UTC](https://discuss.elastic.co/t/multisource-index-on-elasticsearch-passing-by-logstash/330844 "2023-04-28T15:57:42Z")
hey , im trying to create multiple source input from Filebeat , than injecting them into logstash to apply filters , and finally transfer the sources to elasticsearch as indexes The problem i have , only one index is cr… --- ## [Is there any known issues for high shared and buff/cache usage with elasticsearch java client](https://discuss.elastic.co/t/is-there-any-known-issues-for-high-shared-and-buff-cache-usage-with-elasticsearch-java-client/374797)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 16\ **Last updated:** [March 14, 2025, 11:05am UTC](https://discuss.elastic.co/t/is-there-any-known-issues-for-high-shared-and-buff-cache-usage-with-elasticsearch-java-client/374797 "2025-03-14T11:05:46Z")
i am using below Elasticsearch java client and see high shared and buff/cache memory usage with the application. \ \co.elastic.clients\ \elasticsearch-java\ **Author:** [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\ **Replies:** 9\ **Last updated:** [May 19, 2023, 4:57pm UTC](https://discuss.elastic.co/t/searching-by-ngrams/333872 "2023-05-19T16:57:33Z") I use search with query string in index analyzed with ngrams. When I try to search doc with field\_1 = SU0001023277 it's ok. But when I try to use less letters, like SU0001023 the resultset is 0. Why it comes out like th… --- ## [Cluster breaks very frequently](https://discuss.elastic.co/t/cluster-breaks-very-frequently/317967)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 9\ **Last updated:** [November 3, 2022, 4:35am UTC](https://discuss.elastic.co/t/cluster-breaks-very-frequently/317967 "2022-11-03T04:35:57Z")
I have a 3-node cluster, all are master eligible. I am facing a weird issue of cluster breaks since last month and it's very frequent. I've tried a lot of things to make it stable but nothing works. I am using ES 5.6.16 … --- ## [Grok for this log format](https://discuss.elastic.co/t/grok-for-this-log-format/373247)
**Author:** [@nkknkk](https://discuss.elastic.co/u/nkknkk)\ **Replies:** 16\ **Last updated:** [January 23, 2025, 3:59pm UTC](https://discuss.elastic.co/t/grok-for-this-log-format/373247 "2025-01-23T15:59:02Z")
Hi, I am trying to parse log file. I am using elastic agent. below is the log format \[\<1 15, 2025 11:12:12 AM\>: This is message1\] \[\<1 15, 2025 11:12:12 AM\>: This is message2 \] This is the grok i am using and it only … --- ## [How to store geoshape Linestring with C#?](https://discuss.elastic.co/t/how-to-store-geoshape-linestring-with-c/361950)
**Author:** [@Motsols](https://discuss.elastic.co/u/Motsols)\ **Replies:** 9\ **Last updated:** [June 30, 2024, 8:27am UTC](https://discuss.elastic.co/t/how-to-store-geoshape-linestring-with-c/361950 "2024-06-30T08:27:48Z")
Using the latest .NET client Elastic.Clients.Elasticsearch 8.14.3, how can I in code add a geoJSON geoshape of type LineString to Elasticsearch? The documentation is completely lacking information on this and I have yet… --- ## [ElasticSearch Index Storage Optimization - Firewall Logs](https://discuss.elastic.co/t/elasticsearch-index-storage-optimization-firewall-logs/338410)
**Author:** [@viera120](https://discuss.elastic.co/u/viera120)\ **Replies:** 9\ **Last updated:** [July 20, 2023, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-index-storage-optimization-firewall-logs/338410 "2023-07-20T11:51:59Z")
We are running a 3 node cluster to index logs from a firewall. The nodes are physical machines (20 Core CPUs, 16GB RAM, SSD Storage). Each days logs are stored in an individual index. The storage utilized per index wor… --- ## [ES, kibana both having ca.crt issues?](https://discuss.elastic.co/t/es-kibana-both-having-ca-crt-issues/389738)
**Author:** [@rik](https://discuss.elastic.co/u/rik)\ **Replies:** 12\ **Last updated:** [August 21, 2026, 10:13am UTC](https://discuss.elastic.co/t/es-kibana-both-having-ca-crt-issues/389738 "2026-08-21T10:13:56Z")
I'm not able to start up either the ES or kibana containers and I suspect the root cause has to do with ca-cert issues. i'm attaching my compose file below for reference with ES, the log shows this error: "@timestamp"… --- ## [Logstash Pipeline](https://discuss.elastic.co/t/logstash-pipeline/375396)
**Author:** [@JosephR](https://discuss.elastic.co/u/JosephR)\ **Replies:** 18\ **Last updated:** [March 5, 2025, 5:52pm UTC](https://discuss.elastic.co/t/logstash-pipeline/375396 "2025-03-05T17:52:19Z")
I have quite a few logstash conf files written out that have to be kicked off manually at the moment. Is there a way to cause them to run automatically? I need to basically tie what I bring in to a dashboard that consta… --- ## [Fields are not populating from logstash to elastic](https://discuss.elastic.co/t/fields-are-not-populating-from-logstash-to-elastic/348593)
**Author:** [@mmercaldi](https://discuss.elastic.co/u/mmercaldi)\ **Replies:** 10\ **Last updated:** [December 5, 2023, 10:44pm UTC](https://discuss.elastic.co/t/fields-are-not-populating-from-logstash-to-elastic/348593 "2023-12-05T22:44:34Z")
I am using logstash to populate elastic I have it set so this filter: filter { json { source =\> "message" target =\> "jsoncontent" remove\_field =\> \["message"\] } } and jsoncontent: {"switchname": "swi… --- ## [Control visualization](https://discuss.elastic.co/t/control-visualization/272158)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 10:37am UTC](https://discuss.elastic.co/t/control-visualization/272158 "2021-05-06T10:37:59Z")
Dear all, it is possible to use Control visualization to filter on group of parameters? Suppose that there are: Test ServerTest-1 ServerTest-2 Prod ServerProd-1 ServerProd-2 It is possible to have Control … --- ## [Multiline logs into one event using logstash?](https://discuss.elastic.co/t/multiline-logs-into-one-event-using-logstash/320005)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 9\ **Last updated:** [December 2, 2022, 10:14am UTC](https://discuss.elastic.co/t/multiline-logs-into-one-event-using-logstash/320005 "2022-12-02T10:14:08Z")
hi all! I have these logs: Nov 23 18:57:14 mx.host.cloud 18:57:14.756 2 SIPS-072111 SIPDATA-124634 REGISTER sip:111.222.333.444:65110 from udp\[555.666.777.888\]:65111 Nov 23 18:57:14 mx.host.cloud 18:57:14.756 2 SIPS-072… --- ## [I have a cluster with 4 nodes , 2 master and 2 data nodes, currently only one master is responding, all the other nodes connect for 10 mins and shard allocation start, then again it becomes NA , not sure what is the issue?](https://discuss.elastic.co/t/i-have-a-cluster-with-4-nodes-2-master-and-2-data-nodes-currently-only-one-master-is-responding-all-the-other-nodes-connect-for-10-mins-and-shard-allocation-start-then-again-it-becomes-na-not-sure-what-is-the-issue/339012)
**Author:** [@vishnu\_ishpujani](https://discuss.elastic.co/u/vishnu_ishpujani)\ **Replies:** 10\ **Last updated:** [July 24, 2023, 4:43am UTC](https://discuss.elastic.co/t/i-have-a-cluster-with-4-nodes-2-master-and-2-data-nodes-currently-only-one-master-is-responding-all-the-other-nodes-connect-for-10-mins-and-shard-allocation-start-then-again-it-becomes-na-not-sure-what-is-the-issue/339012 "2023-07-24T04:43:55Z")
I have a cluster with 4 nodes , 2 master and 2 data nodes, currently only one master is responding, all the other nodes connect for 10 mins and shard allocation start, then again it becomes NA , not sure what is the issu… --- ## [MacOS agents are unhealthy due to Defend Endpoint](https://discuss.elastic.co/t/macos-agents-are-unhealthy-due-to-defend-endpoint/379616)
**Author:** [@hairless\_mess](https://discuss.elastic.co/u/hairless_mess)\ **Replies:** 12\ **Last updated:** [July 11, 2025, 7:38am UTC](https://discuss.elastic.co/t/macos-agents-are-unhealthy-due-to-defend-endpoint/379616 "2025-07-11T07:38:28Z")
Hello everyone, I have a problem with all my MacOS agents. As you can see below, the Agent itself was enrolled successfully and is sending logs, however, the Defend integration gives the error you see in the screenshot. … --- ## [Exact match in query](https://discuss.elastic.co/t/exact-match-in-query/373538)
**Author:** [@mariana.upcodes](https://discuss.elastic.co/u/mariana.upcodes)\ **Replies:** 12\ **Last updated:** [January 25, 2025, 8:29am UTC](https://discuss.elastic.co/t/exact-match-in-query/373538 "2025-01-25T08:29:42Z")
We currently use the following query: "query": { "bool": { "should": \[\], "must": \[ { "multi\_match": { "query": "but not both", "type": "phrase", "… --- ## [Having trouble connecting to Kibana. New user](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476)
**Author:** [@CarlosDanger142](https://discuss.elastic.co/u/CarlosDanger142)\ **Replies:** 19\ **Last updated:** [January 22, 2025, 10:59pm UTC](https://discuss.elastic.co/t/having-trouble-connecting-to-kibana-new-user/373476 "2025-01-22T22:59:44Z")
Can't get the server to listen on port 5601. netstat -ant shows nothing on port 5601. Getting connection refused on port 5601 with Curl. telemetry.enabled: false telemetry.optIn: false newsfeed.enabled: false se… --- ## [Transform results in index with missing documents when using the API but works for console](https://discuss.elastic.co/t/transform-results-in-index-with-missing-documents-when-using-the-api-but-works-for-console/363044)
**Author:** [@Phil\_McLachlan](https://discuss.elastic.co/u/Phil_McLachlan)\ **Replies:** 13\ **Last updated:** [July 19, 2024, 6:38pm UTC](https://discuss.elastic.co/t/transform-results-in-index-with-missing-documents-when-using-the-api-but-works-for-console/363044 "2024-07-19T18:38:22Z")
Hi. We have developed a transform that works given the same input indices in the console. However, when using the golang TransformPutTransform API, many of the documents are missing in the resulting index. Here is the… --- ## [Mappings (Ignore\_above)](https://discuss.elastic.co/t/mappings-ignore-above/363076)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 15\ **Last updated:** [July 14, 2024, 2:55pm UTC](https://discuss.elastic.co/t/mappings-ignore-above/363076 "2024-07-14T14:55:56Z")
I have a field with data of numbers, letters, symbols, and the length of this dystrophy is more than 255, and I want to use term to return the data accurately, but it does not return anything, and when I use match, it re… --- ## [\[ANN\] RSS River Plugin 0.0.6](https://discuss.elastic.co/t/ann-rss-river-plugin-0-0-6/6628)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 9\ **Last updated:** [February 22, 2012, 8:53pm UTC](https://discuss.elastic.co/t/ann-rss-river-plugin-0-0-6/6628 "2012-02-22T20:53:38Z")
RSS River 0.0.6 has just been released \[1\]. RSS River will now works with the new Elasticsearch 0.19.0.RC1 release candidate. Please feel free to test it, fork it, create issues, contribute. ;-) \[… --- ## [Grafana to Elastic stack migration](https://discuss.elastic.co/t/grafana-to-elastic-stack-migration/387604)
**Author:** [@Ts\_P](https://discuss.elastic.co/u/Ts_P)\ **Replies:** 11\ **Last updated:** [July 27, 2026, 3:28pm UTC](https://discuss.elastic.co/t/grafana-to-elastic-stack-migration/387604 "2026-07-27T15:28:18Z")
I wanna migrate from Grafana to Elastic stack . I found this repository and few articles. Can I download the binary files directly obs-migrate?(for windows 11 x64) --- ## [Setting up self managed ELK stack with TLS/HTTPS issue](https://discuss.elastic.co/t/setting-up-self-managed-elk-stack-with-tls-https-issue/385102)
**Author:** [@BenNCSU](https://discuss.elastic.co/u/BenNCSU)\ **Replies:** 11\ **Last updated:** [March 5, 2026, 2:16am UTC](https://discuss.elastic.co/t/setting-up-self-managed-elk-stack-with-tls-https-issue/385102 "2026-03-05T02:16:44Z")
I’m trying to set up an ELK stack for SIEM doing a standard install. I installed Elasticsearch and Kibana, which worked fine using HTTP, but when I tried to set up TLS using a self-signed certificate from our CA, I can’… --- ## [ElasticAgent 8.13 and Kafka](https://discuss.elastic.co/t/elasticagent-8-13-and-kafka/358704)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 9\ **Last updated:** [May 7, 2024, 1:22pm UTC](https://discuss.elastic.co/t/elasticagent-8-13-and-kafka/358704 "2024-05-07T13:22:24Z")
I'm using ElasticAgent to output data into Kafka. When using version 8.13.3 there is an error: status: (FAILED) could not start output: failed to reload output: topic '%{\[fields.kafka\_topic\]}' is invalid, it must match … --- ## [Error while caching](https://discuss.elastic.co/t/error-while-caching/4748)
**Author:** [@nachiket](https://discuss.elastic.co/u/nachiket)\ **Replies:** 10\ **Last updated:** [July 2, 2011, 9:26am UTC](https://discuss.elastic.co/t/error-while-caching/4748 "2011-07-02T09:26:01Z")
Hi. My elastic search was working fine before I tried to configure cache filter. I tried to do this -\> curl -XPUT localhost:9200/twitter/\_settings -d { "index" : { "number\_of\_replicas" : 4, "type": "… --- ## [The elasticsearch cluster often turns red,marking and sending shard failed due to \[failed to create shard\]](https://discuss.elastic.co/t/the-elasticsearch-cluster-often-turns-red-marking-and-sending-shard-failed-due-to-failed-to-create-shard/364759)
**Author:** [@xiaxiantao](https://discuss.elastic.co/u/xiaxiantao)\ **Replies:** 9\ **Last updated:** [August 13, 2024, 10:34am UTC](https://discuss.elastic.co/t/the-elasticsearch-cluster-often-turns-red-marking-and-sending-shard-failed-due-to-failed-to-create-shard/364759 "2024-08-13T10:34:51Z")
continue with the previous issue on GitHub，I found that this problem mostly occurs on one index. An index often shows "failed to obtain in-memory shard lock", resulting in shard unassignment. Both primary and replica sha… --- ## [How to parse date field into @timestamp](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/351058)
**Author:** [@emoxam](https://discuss.elastic.co/u/emoxam)\ **Replies:** 9\ **Last updated:** [January 17, 2024, 12:10pm UTC](https://discuss.elastic.co/t/how-to-parse-date-field-into-timestamp/351058 "2024-01-17T12:10:13Z")
i receive the spring app logs and i want to parse time from logs to @timestamp that's what i got but timestamp is not the same. input { tcp { port =\> 5000 codec =\>plain } } filter { if \[message\] =~ /actions/ { … --- ## [Ideas for helping prevent users requesting every log ever](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190)
**Author:** [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Replies:** 9\ **Last updated:** [March 27, 2019, 9:46pm UTC](https://discuss.elastic.co/t/ideas-for-helping-prevent-users-requesting-every-log-ever/174190 "2019-03-27T21:46:33Z")
Hello, I'm trying to come up with a good solution to what I would think is a common problem. Currently managing a cluster over 1PB of data, when a user logs in they get the default discovery page which runs the query to… --- ## [Logstash not able to parse logs with spaces between key value pair in json object](https://discuss.elastic.co/t/logstash-not-able-to-parse-logs-with-spaces-between-key-value-pair-in-json-object/356011)
**Author:** [@Dhruvi\_Shah](https://discuss.elastic.co/u/Dhruvi_Shah)\ **Replies:** 10\ **Last updated:** [March 25, 2024, 5:27pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-parse-logs-with-spaces-between-key-value-pair-in-json-object/356011 "2024-03-25T17:27:55Z")
I have a log containing json object. The log gets parsed if json object has no spaces. If it has spaces between key value pair, it is not getting parsed. Configuration file used input { syslog { port =\> 3011 } } filte… --- ## [Treating Logs as Milk, not Wine (the art of playing catchup)](https://discuss.elastic.co/t/treating-logs-as-milk-not-wine-the-art-of-playing-catchup/280257)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 9\ **Last updated:** [August 3, 2021, 3:04am UTC](https://discuss.elastic.co/t/treating-logs-as-milk-not-wine-the-art-of-playing-catchup/280257 "2021-08-03T03:04:29Z")
I'm have a logging pipeline that looks something like the following: Logstash/Rsyslog/etc (submission) -\> Kafka -\> Logstash (enrichment) -\> Elasticsearch Metrics tells me that the by-far slowest part of my pipeline in … --- ## [Snapshot not registering on remote cluster](https://discuss.elastic.co/t/snapshot-not-registering-on-remote-cluster/361549)
**Author:** [@Rokni](https://discuss.elastic.co/u/Rokni)\ **Replies:** 11\ **Last updated:** [June 20, 2024, 10:10am UTC](https://discuss.elastic.co/t/snapshot-not-registering-on-remote-cluster/361549 "2024-06-20T10:10:47Z")
Hey, We are trying to restore a snapshot on a remote cluster of ours. We have created an S3 snapshot repo in the source cluster, took the snapshot and then we restore this snapshot on a remote es cluster. We are witne… --- ## [When i import a map to my dashboard it loses some of the details](https://discuss.elastic.co/t/when-i-import-a-map-to-my-dashboard-it-loses-some-of-the-details/361127)
**Author:** [@thomas4](https://discuss.elastic.co/u/thomas4)\ **Replies:** 12\ **Last updated:** [June 17, 2024, 10:29am UTC](https://discuss.elastic.co/t/when-i-import-a-map-to-my-dashboard-it-loses-some-of-the-details/361127 "2024-06-17T10:29:58Z")
Morning all, Hoping you can help me with this, when I create a map and I then move it into a dashboard I lose a lot of the detail when I zoom in, see screen shots. Before I move to a dashboard: After i move to dash… [Previous page](https://discuss.elastic.co/top.md?page=243&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=245&per_page=50&period=all)