# Top

**URL:** https://discuss.elastic.co/top.md?page=253&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 254

---

## [Dec 4th, 2020: \[EN\] Validate Elastic Common Schema (ECS) fields using Security Detection Rules](https://discuss.elastic.co/t/dec-4th-2020-en-validate-elastic-common-schema-ecs-fields-using-security-detection-rules/254805)

<div class="topic-metadata">

**Author:** [@ebeahan](https://discuss.elastic.co/u/ebeahan)\
**Replies:** 0\
**Last updated:** [December 4, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-4th-2020-en-validate-elastic-common-schema-ecs-fields-using-security-detection-rules/254805 "2020-12-04T08:00:00Z")

</div>

Introduction The Elastic Common Schema (ECS) provides an open, consistent model for structuring your data in the Elastic Stack. By normalizing data to a single common model, you can uniformly examine your data using int…

---

## [Kibana cannot connect to ES cluster - Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/kibana-cannot-connect-to-es-cluster-unable-to-retrieve-version-information-from-elasticsearch-nodes/278185)

<div class="topic-metadata">

**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\
**Replies:** 4\
**Last updated:** [July 15, 2021, 5:50am UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-es-cluster-unable-to-retrieve-version-information-from-elasticsearch-nodes/278185 "2021-07-15T05:50:36Z")

</div>

Kibana and ES version: 7.13.2 I am running cluster of 5 nodes (3 ES data & master nodes and 2 coordinating nodes) and one Kibana. Whole cluster is running in docker swarm on the same network. My ES cluster works fine, I…

---

## [Logstash input JDBC plugin and MariaDB](https://discuss.elastic.co/t/logstash-input-jdbc-plugin-and-mariadb/186985)

<div class="topic-metadata">

**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\
**Replies:** 0\
**Last updated:** [June 23, 2019, 6:51am UTC](https://discuss.elastic.co/t/logstash-input-jdbc-plugin-and-mariadb/186985 "2019-06-23T06:51:43Z")

</div>

Hi Elasticians, I prepared example How to connect to MariaDB using Logstash JDBC input plugin. I hope it will save some time :wink: Servers ES node - 10.88.88.231 MariaDB server - 10.88.88.150 \[10.88.88.231\] Down…

---

## [Log4j2.properties: An example of a multiple conditions configuration for an elasticsearch 7 cluster (7.6.1)](https://discuss.elastic.co/t/log4j2-properties-an-example-of-a-multiple-conditions-configuration-for-an-elasticsearch-7-cluster-7-6-1/249939)

<div class="topic-metadata">

**Author:** [@ginolegigot](https://discuss.elastic.co/u/ginolegigot)\
**Replies:** 0\
**Last updated:** [September 25, 2020, 9:22am UTC](https://discuss.elastic.co/t/log4j2-properties-an-example-of-a-multiple-conditions-configuration-for-an-elasticsearch-7-cluster-7-6-1/249939 "2020-09-25T09:22:44Z")

</div>

Due to the lack of a proper documentation on this matter (yes it's not that obvious how you write a log4j.properties based on xml examples from log4j2 documentation), I thought it would have been useful to share my log4j…

---

## [How to remove fields in logstash/es](https://discuss.elastic.co/t/how-to-remove-fields-in-logstash-es/77039)

<div class="topic-metadata">

**Author:** [@bob-bza](https://discuss.elastic.co/u/bob-bza)\
**Replies:** 5\
**Last updated:** [March 1, 2017, 9:37pm UTC](https://discuss.elastic.co/t/how-to-remove-fields-in-logstash-es/77039 "2017-03-01T21:37:54Z")

</div>

This was my index looks like in kibana. I don't want so many fields below, so how can i delete/avoid those from my index. Ex.: id, \_score, version, beat info. { "\_index": "test", "\_type": "testing", "\_id": "AVqK…

---

## [Term query vs match query](https://discuss.elastic.co/t/term-query-vs-match-query/14455)

<div class="topic-metadata">

**Author:** [@Mohit\_Anchlia](https://discuss.elastic.co/u/Mohit_Anchlia)\
**Replies:** 6\
**Last updated:** [August 26, 2016, 2:30pm UTC](https://discuss.elastic.co/t/term-query-vs-match-query/14455 "2016-08-26T14:30:52Z")

</div>

Could somebody help me understand the difference between a term query and a match query? I saw the explanation on the elasticsearch site but couldn't quite follow. Isn't search always trying to match terms? -- You…

---

## [Dec 12th, 2019 \[EN\] \[Elasticsearch\] Data Transforms: More Than Meets the Eye](https://discuss.elastic.co/t/dec-12th-2019-en-elasticsearch-data-transforms-more-than-meets-the-eye/210991)

<div class="topic-metadata">

**Author:** [@kcm](https://discuss.elastic.co/u/kcm)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-12th-2019-en-elasticsearch-data-transforms-more-than-meets-the-eye/210991 "2019-12-12T08:00:06Z")

</div>

With great power comes great responsibility You're running at scale, with petabytes of proxy logs, desktop event streams, and endpoint security alerts at your fingertips. The thing is, human beings don't think about log …

---

## [Visualizations Broken After Deleting Index Pattern (Resolved) "The index pattern associated with this object no longer exists."](https://discuss.elastic.co/t/visualizations-broken-after-deleting-index-pattern-resolved-the-index-pattern-associated-with-this-object-no-longer-exists/181452)

<div class="topic-metadata">

**Author:** [@Saris](https://discuss.elastic.co/u/Saris)\
**Replies:** 1\
**Last updated:** [May 16, 2019, 5:21pm UTC](https://discuss.elastic.co/t/visualizations-broken-after-deleting-index-pattern-resolved-the-index-pattern-associated-with-this-object-no-longer-exists/181452 "2019-05-16T17:21:42Z")

</div>

I deleted and recreated an Index Pattern which broken visualizations associated to the old Index Pattern. I used the following GET request on Dev Tools Console to list our Index Patterns and obtain the new Index Pattern…

---

## [How to change the default amount of shards and replicas of indices?](https://discuss.elastic.co/t/how-to-change-the-default-amount-of-shards-and-replicas-of-indices/95989)

<div class="topic-metadata">

**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\
**Replies:** 5\
**Last updated:** [August 7, 2017, 9:07am UTC](https://discuss.elastic.co/t/how-to-change-the-default-amount-of-shards-and-replicas-of-indices/95989 "2017-08-07T09:07:06Z")

</div>

ELK version: 5.5.1 I referred to this page https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-update-settings.html and changed a index’s number of replica, and it worked, but how to add it to the confi…

---

## [How to update all the documents in elastic seach](https://discuss.elastic.co/t/how-to-update-all-the-documents-in-elastic-seach/114018)

<div class="topic-metadata">

**Author:** [@happy0088](https://discuss.elastic.co/u/happy0088)\
**Replies:** 5\
**Last updated:** [January 4, 2018, 10:24am UTC](https://discuss.elastic.co/t/how-to-update-all-the-documents-in-elastic-seach/114018 "2018-01-04T10:24:30Z")

</div>

Hi, I need to update all the value of the keys named as "per\_name" (key is the document Json key:value pair entry ) in all the documents in all the indexes present in my Elastic Search . I have an update curl which tak…

---

## [How to move Data and Logs to new directory?](https://discuss.elastic.co/t/how-to-move-data-and-logs-to-new-directory/28382)

<div class="topic-metadata">

**Author:** [@dkraut](https://discuss.elastic.co/u/dkraut)\
**Replies:** 2\
**Last updated:** [September 1, 2015, 6:33am UTC](https://discuss.elastic.co/t/how-to-move-data-and-logs-to-new-directory/28382 "2015-09-01T06:33:31Z")

</div>

I installed ElasticSearch using defaults. Now my /var directory is full. I'd like to move ES to a different partition on the server without losing data. Can this be done and if so, how? More specifically, I'd like t…

---

## [\[Error\] Setup-passwords: Failed to determine the health of the cluster](https://discuss.elastic.co/t/error-setup-passwords-failed-to-determine-the-health-of-the-cluster/207649)

<div class="topic-metadata">

**Author:** [@cjsjyh](https://discuss.elastic.co/u/cjsjyh)\
**Replies:** 2\
**Last updated:** [November 13, 2019, 11:00am UTC](https://discuss.elastic.co/t/error-setup-passwords-failed-to-determine-the-health-of-the-cluster/207649 "2019-11-13T11:00:59Z")

</div>

I get this error when trying to setup password: /usr/share/elasticsearch/bin# sudo ./elasticsearch-setup-passwords interactive Failed to determine the health of the cluster running at http://172.31.47.37:9200 Unexpecte…

---

## [Parent-child v/s multiple indexes - Elasticsearch 6.0+](https://discuss.elastic.co/t/parent-child-v-s-multiple-indexes-elasticsearch-6-0/131648)

<div class="topic-metadata">

**Author:** [@Nithin\_Chandy](https://discuss.elastic.co/u/Nithin_Chandy)\
**Replies:** 0\
**Last updated:** [May 14, 2018, 1:28am UTC](https://discuss.elastic.co/t/parent-child-v-s-multiple-indexes-elasticsearch-6-0/131648 "2018-05-14T01:28:09Z")

</div>

We currently have a ES 5.3 cluster which uses parent-child mapping as our data follows this model. Parent-child mapping was the best option as it supported cluster-side joins and provided performance benefits from being …

---

## [Dec 3rd 2021: \[en\] What's new in the Elasticsearch Python client 8.0.0](https://discuss.elastic.co/t/dec-3rd-2021-en-whats-new-in-the-elasticsearch-python-client-8-0-0/289203)

<div class="topic-metadata">

**Author:** [@sethmlarson](https://discuss.elastic.co/u/sethmlarson)\
**Replies:** 0\
**Last updated:** [December 3, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-3rd-2021-en-whats-new-in-the-elasticsearch-python-client-8-0-0/289203 "2021-12-03T08:00:33Z")

</div>

There's an 8.0.0 pre-release out for the Elasticsearch client, fresh off the press! You can give it a try yourself or skip to the "What's new" section to read about all the new features coming in 8.0.0. Getting started S…

---

## [What's the differece between index pattern and index template](https://discuss.elastic.co/t/whats-the-differece-between-index-pattern-and-index-template/54948)

<div class="topic-metadata">

**Author:** [@fjiang212](https://discuss.elastic.co/u/fjiang212)\
**Replies:** 2\
**Last updated:** [July 7, 2016, 4:51pm UTC](https://discuss.elastic.co/t/whats-the-differece-between-index-pattern-and-index-template/54948 "2016-07-07T16:51:46Z")

</div>

I am a little confused about index pattern in kibana and index template in the elasticsearch, could someone explain what is the difference between these two ? Should we load the index template first before creating inde…

---

## [Dec 12th, 2020: \[EN\] Mapping your infrastructure](https://discuss.elastic.co/t/dec-12th-2020-en-mapping-your-infrastructure/257864)

<div class="topic-metadata">

**Author:** [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Replies:** 0\
**Last updated:** [December 12, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-12th-2020-en-mapping-your-infrastructure/257864 "2020-12-12T08:00:04Z")

</div>

Also available in Spanish tl;dr; This post shows how you can use the Elastic Stack to map IoT, Security or Observability data. The data that is collected in these use-cases often do not explicitly contain a latitude o…

---

## [Dec 13th, 2022: \[en\] Debugging Logstash and Filebeat pipelines with Logshark](https://discuss.elastic.co/t/dec-13th-2022-en-debugging-logstash-and-filebeat-pipelines-with-logshark/319308)

<div class="topic-metadata">

**Author:** [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)\
**Replies:** 1\
**Last updated:** [December 14, 2022, 11:29am UTC](https://discuss.elastic.co/t/dec-13th-2022-en-debugging-logstash-and-filebeat-pipelines-with-logshark/319308 "2022-12-14T11:29:53Z")

</div>

I worked for many years as a consultant in Elastic, and coding pipelines in Logstash and Filebeat for large Observability use cases that ingested terabytes worth of logs every day was our bread and butter. Coding pip…

---

## [Deleting log files after they have finished processing](https://discuss.elastic.co/t/deleting-log-files-after-they-have-finished-processing/246382)

<div class="topic-metadata">

**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Replies:** 0\
**Last updated:** [August 26, 2020, 4:17am UTC](https://discuss.elastic.co/t/deleting-log-files-after-they-have-finished-processing/246382 "2020-08-26T04:17:44Z")

</div>

Filebeat does not have the capabilities to handle deleting files from a host's filesystem after they have been processed. The best option is to use a cron job or scheduled task on your OS to delete them after a safe peri…

---

## [Index name, type name and field name rules](https://discuss.elastic.co/t/index-name-type-name-and-field-name-rules/133039)

<div class="topic-metadata">

**Author:** [@Prathap\_BN](https://discuss.elastic.co/u/Prathap_BN)\
**Replies:** 3\
**Last updated:** [May 25, 2018, 2:24pm UTC](https://discuss.elastic.co/t/index-name-type-name-and-field-name-rules/133039 "2018-05-25T14:24:21Z")

</div>

I am using ES 6. What are exact rules regarding formation of index name, type name and field name strings.. I know ES only takes lower case.. Does it apply to field names too? Is this documented officially somewhere? I …

---

## [Threat Intel and SIEM](https://discuss.elastic.co/t/threat-intel-and-siem/255404)

<div class="topic-metadata">

**Author:** [@randomguy](https://discuss.elastic.co/u/randomguy)\
**Replies:** 2\
**Last updated:** [November 17, 2020, 10:27am UTC](https://discuss.elastic.co/t/threat-intel-and-siem/255404 "2020-11-17T10:27:10Z")

</div>

Hi, I'm looking for a SIEM solution for our company. At the moment I'm trying to do it with ELK. My goal is: I would like to create fancy dashboards, alerts with events correlated from Threat Intel. I would like to u…

---

## [Could not find or load main class Files\\logstash\\logstash-core\\lib\\jars\\animal-sniffer-annotations-1.14.jar;C:Program](https://discuss.elastic.co/t/could-not-find-or-load-main-class-files-logstash-logstash-core-lib-jars-animal-sniffer-annotations-1-14-jar-c-program/150360)

<div class="topic-metadata">

**Author:** [@kunalwagh](https://discuss.elastic.co/u/kunalwagh)\
**Replies:** 3\
**Last updated:** [October 16, 2018, 11:17pm UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-files-logstash-logstash-core-lib-jars-animal-sniffer-annotations-1-14-jar-c-program/150360 "2018-10-16T23:17:31Z")

</div>

Downloaded the latest package and Installed Logstash in C:\\Program Files. Installed JAVA\_HOME to " C:\\Program Files\\Java\\jdk1.8.0\_181 " Checked echo %java\_home% ==\> showing up the same Checked java -version sho…

---

## [Dec 19th, 2017: \[EN\]\[Kibana\] A Brief Tour of Kubernetes Monitoring with the Elastic Stack](https://discuss.elastic.co/t/dec-19th-2017-en-kibana-a-brief-tour-of-kubernetes-monitoring-with-the-elastic-stack/112038)

<div class="topic-metadata">

**Author:** [@tylerjl](https://discuss.elastic.co/u/tylerjl)\
**Replies:** 1\
**Last updated:** [December 21, 2017, 6:59am UTC](https://discuss.elastic.co/t/dec-19th-2017-en-kibana-a-brief-tour-of-kubernetes-monitoring-with-the-elastic-stack/112038 "2017-12-21T06:59:09Z")

</div>

You know what sounds like pleasant technical reading during the holidays? A whole bunch of pretty visualizations! I recently started managing Kubernetes. Although it makes my life as an operations engineer loads easier,…

---

## [Rejecting mapping update to \[\] as the final mapping would have more than 1 type: \[\_doc, doc\]](https://discuss.elastic.co/t/rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-doc/135985)

<div class="topic-metadata">

**Author:** [@dmongit](https://discuss.elastic.co/u/dmongit)\
**Replies:** 3\
**Last updated:** [June 15, 2018, 8:03pm UTC](https://discuss.elastic.co/t/rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-doc/135985 "2018-06-15T20:03:15Z")

</div>

I have my own mapping that I dump to my running localhost:9200/abc. In my elasticsearch.yml I have action.auto\_create\_index: false I have a docker-compose that spins up elasticsearch, kibana and logstash. Logstash inp…

---

## [Store.size of an index](https://discuss.elastic.co/t/store-size-of-an-index/115818)

<div class="topic-metadata">

**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\
**Replies:** 5\
**Last updated:** [January 17, 2018, 3:58am UTC](https://discuss.elastic.co/t/store-size-of-an-index/115818 "2018-01-17T03:58:39Z")

</div>

Hi there! i am not clear on store.size and pri.store.size. health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open logstash-2018.01.16 5 1 24…

---

## [What is the difference between @timestamp and timestamp?](https://discuss.elastic.co/t/what-is-the-difference-between-timestamp-and-timestamp/46464)

<div class="topic-metadata">

**Author:** [@Kramer\_Li](https://discuss.elastic.co/u/Kramer_Li)\
**Replies:** 4\
**Last updated:** [April 6, 2016, 3:10am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-timestamp-and-timestamp/46464 "2016-04-06T03:10:32Z")

</div>

The timestamp field usually have a "@" prefix. Why? What is the difference if we do not add it ?

---

## [How to filter records containing a particular string in a field value for a kibana visualization](https://discuss.elastic.co/t/how-to-filter-records-containing-a-particular-string-in-a-field-value-for-a-kibana-visualization/174532)

<div class="topic-metadata">

**Author:** [@tismayank](https://discuss.elastic.co/u/tismayank)\
**Replies:** 3\
**Last updated:** [April 1, 2019, 5:49pm UTC](https://discuss.elastic.co/t/how-to-filter-records-containing-a-particular-string-in-a-field-value-for-a-kibana-visualization/174532 "2019-04-01T17:49:48Z")

</div>

I have a kibana visualization that shows the counts of clicks on a field that contains a url as value. I want to filter the data that contains the particular url. For e.g : I am having a field namely "pageUrl" and values…

---

## [Indices status shows yellow](https://discuss.elastic.co/t/indices-status-shows-yellow/93918)

<div class="topic-metadata">

**Author:** [@sanketdarji](https://discuss.elastic.co/u/sanketdarji)\
**Replies:** 4\
**Last updated:** [July 20, 2017, 12:27pm UTC](https://discuss.elastic.co/t/indices-status-shows-yellow/93918 "2017-07-20T12:27:16Z")

</div>

health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open .kibana 5 1 9 0 41.3kb 41.3kb yellow open logstash-2017.07.20 …

---

## [Metricbeat system module filtering tips and tricks](https://discuss.elastic.co/t/metricbeat-system-module-filtering-tips-and-tricks/71051)

<div class="topic-metadata">

**Author:** [@heilaaks](https://discuss.elastic.co/u/heilaaks)\
**Replies:** 0\
**Last updated:** [January 10, 2017, 10:03am UTC](https://discuss.elastic.co/t/metricbeat-system-module-filtering-tips-and-tricks/71051 "2017-01-10T10:03:15Z")

</div>

Hello/FYI, I had problems using the Metricbeat filters but I finally figured this out with the help of responses from andrewkroh and monica. Here are few highlights that may be helpful. The instructions and comments ar…

---

## [Dec 23rd, 2021: \[en\] Enriching documents with the geo\_match policy](https://discuss.elastic.co/t/dec-23rd-2021-en-enriching-documents-with-the-geo-match-policy/289302)

<div class="topic-metadata">

**Author:** [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Replies:** 0\
**Last updated:** [December 23, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2021-en-enriching-documents-with-the-geo-match-policy/289302 "2021-12-23T08:00:39Z")

</div>

:speaking\_head: This article is also available in Spanish As you may know, on September 19th of 2021, the Cumbre Vieja volcano eruption started in La Palma, Canary Islands, Spain. The island's government almost immedi…

---

## [Is logstash 7.16.2 effected with CVE-2022-22965.A remote code execution vulnerability](https://discuss.elastic.co/t/is-logstash-7-16-2-effected-with-cve-2022-22965-a-remote-code-execution-vulnerability/301305)

<div class="topic-metadata">

**Author:** [@rama543](https://discuss.elastic.co/u/rama543)\
**Replies:** 0\
**Last updated:** [April 1, 2022, 10:09am UTC](https://discuss.elastic.co/t/is-logstash-7-16-2-effected-with-cve-2022-22965-a-remote-code-execution-vulnerability/301305 "2022-04-01T10:09:54Z")

</div>

We deployed Logstash 7.16.2 version in amazon EC2 instances . Is logstash imacted with this new vulnerability CVE-2022-22965(Spring4shell) A remote code execution vulnerability Thanks

---

## [Elastic Stack on Raspberry Pi](https://discuss.elastic.co/t/elastic-stack-on-raspberry-pi/256261)

<div class="topic-metadata">

**Author:** [@jamesgarside](https://discuss.elastic.co/u/jamesgarside)\
**Replies:** 1\
**Last updated:** [December 15, 2020, 3:42pm UTC](https://discuss.elastic.co/t/elastic-stack-on-raspberry-pi/256261 "2020-12-15T15:42:09Z")

</div>

Hi All, I have been working on a project to make it possible for people to deploy an Elastic Stack on a Raspberry Pi. Current versions 7.10.0 7.9.3 At current I have made this Docker Swarm based. This has various ad…

---

## [Vega heatmap chart for matrix stats (correlation)](https://discuss.elastic.co/t/vega-heatmap-chart-for-matrix-stats-correlation/226099)

<div class="topic-metadata">

**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\
**Replies:** 2\
**Last updated:** [April 2, 2020, 3:16pm UTC](https://discuss.elastic.co/t/vega-heatmap-chart-for-matrix-stats-correlation/226099 "2020-04-02T15:16:11Z")

</div>

Hi I struggled to display a heatmap showing the correlation of fields (calling the matrix\_stats agg from Elasticsearch). Many many thanks to my colleague Yuri that helped me on this :+1: Here is the code that works: {…

---

## [How can i give Restful API as input in log stash cons file](https://discuss.elastic.co/t/how-can-i-give-restful-api-as-input-in-log-stash-cons-file/70452)

<div class="topic-metadata">

**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\
**Replies:** 1\
**Last updated:** [January 3, 2017, 10:54pm UTC](https://discuss.elastic.co/t/how-can-i-give-restful-api-as-input-in-log-stash-cons-file/70452 "2017-01-03T22:54:59Z")

</div>

I want to use Restfull API as input for logstsh. Which plugin i can use to get data by using RESTFUL API. Please provide logstash conf file.

---

## [Dec 23rd, 2017: \[EN\]\[Kibana\] Kibana tips for new users](https://discuss.elastic.co/t/dec-23rd-2017-en-kibana-kibana-tips-for-new-users/112954)

<div class="topic-metadata">

**Author:** [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Replies:** 0\
**Last updated:** [December 23, 2017, 12:00am UTC](https://discuss.elastic.co/t/dec-23rd-2017-en-kibana-kibana-tips-for-new-users/112954 "2017-12-23T00:00:03Z")

</div>

Welcome to the Elastic Advent Calendar, Day 23! Today I am hoping to give some tips to new users of Kibana. I started working at Elastic roughly an year ago as a QA engineer in the Kibana team. I don’t have a search back…

---

## [Tried to parse field as object, but found a concrete value](https://discuss.elastic.co/t/tried-to-parse-field-as-object-but-found-a-concrete-value/229134)

<div class="topic-metadata">

**Author:** [@Sirius](https://discuss.elastic.co/u/Sirius)\
**Replies:** 2\
**Last updated:** [April 22, 2020, 12:07am UTC](https://discuss.elastic.co/t/tried-to-parse-field-as-object-but-found-a-concrete-value/229134 "2020-04-22T00:07:44Z")

</div>

Hi, I'm running filebeat 7.6.2 with logstash 7.5.1 having missing lines of logs in ES due this warning message ... \[2020-04-21T21:25:21,105\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearc…

---

## [ElasticSearch: how to delete index containing %-character?](https://discuss.elastic.co/t/elasticsearch-how-to-delete-index-containing-character/27647)

<div class="topic-metadata">

**Author:** [@MartinG](https://discuss.elastic.co/u/MartinG)\
**Replies:** 3\
**Last updated:** [August 19, 2015, 8:44am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-delete-index-containing-character/27647 "2015-08-19T08:44:48Z")

</div>

Hello, I accidently created an index containing a %-character and I am not able to delete it. I tried several ways to escape without success. Index name: index-%{env}-2015-08-19 I tried the following: curl -XDELETE…

---

## [Loop over a map in Painless](https://discuss.elastic.co/t/loop-over-a-map-in-painless/70308)

<div class="topic-metadata">

**Author:** [@ashokc](https://discuss.elastic.co/u/ashokc)\
**Replies:** 1\
**Last updated:** [December 31, 2016, 2:15am UTC](https://discuss.elastic.co/t/loop-over-a-map-in-painless/70308 "2016-12-31T02:15:47Z")

</div>

I would like to loop over the entries in the map using the Painless script for updating by query... "script": { "inline" : "for (int i = 0; i \< ctx.source\['Items'\].length; ++i) { if (ctx.source\['Items'\]…

---

## [In scripted fields avoid No field found for \[\] in mapping with types](https://discuss.elastic.co/t/in-scripted-fields-avoid-no-field-found-for-in-mapping-with-types/82883)

<div class="topic-metadata">

**Author:** [@AndreAga](https://discuss.elastic.co/u/AndreAga)\
**Replies:** 5\
**Last updated:** [April 21, 2017, 7:22am UTC](https://discuss.elastic.co/t/in-scripted-fields-avoid-no-field-found-for-in-mapping-with-types/82883 "2017-04-21T07:22:13Z")

</div>

Hi, I'm trying to join/filter two fields stored in two different indeces in the same dashboard. This is my scenario: INDEXA has the field X and Z; INDEXB has the field Y and Z. X and Y contain some values in common. …

---

## [Dec 15th, 2018 \[EN\]\[APM\] Overhead of the Java agent](https://discuss.elastic.co/t/dec-15th-2018-en-apm-overhead-of-the-java-agent/160559)

<div class="topic-metadata">

**Author:** [@felixbarny](https://discuss.elastic.co/u/felixbarny)\
**Replies:** 0\
**Last updated:** [December 15, 2018, 12:00am UTC](https://discuss.elastic.co/t/dec-15th-2018-en-apm-overhead-of-the-java-agent/160559 "2018-12-15T00:00:06Z")

</div>

APM Java Agent In case you missed the announcement, the APM Java agent is one of the new additions to the collection of APM agents we provide free and Open Source. You can use our agents to get insight into the performan…

---

## [Dec 13th, 2017: \[EN\]\[Beats\]Moving to the Beat: Filebeat config updates in 6.x](https://discuss.elastic.co/t/dec-13th-2017-en-beats-moving-to-the-beat-filebeat-config-updates-in-6-x/111112)

<div class="topic-metadata">

**Author:** [@crayzeigh](https://discuss.elastic.co/u/crayzeigh)\
**Replies:** 0\
**Last updated:** [December 11, 2017, 2:21pm UTC](https://discuss.elastic.co/t/dec-13th-2017-en-beats-moving-to-the-beat-filebeat-config-updates-in-6-x/111112 "2017-12-11T14:21:17Z")

</div>

Moving to the Beat: Filebeat config updates in 6.x Hi everyone :wave:! I am relatively new to the Elastic. Consequently, a good portion of my time has been devoted to shoring up my knowledge, filling the gaps between sel…

---

## [Logstash or condition in if statement](https://discuss.elastic.co/t/logstash-or-condition-in-if-statement/70403)

<div class="topic-metadata">

**Author:** [@aydinnmu](https://discuss.elastic.co/u/aydinnmu)\
**Replies:** 2\
**Last updated:** [January 3, 2017, 10:35am UTC](https://discuss.elastic.co/t/logstash-or-condition-in-if-statement/70403 "2017-01-03T10:35:43Z")

</div>

Hi guys, i want to check multiple condition in if statement. my filter like that but it is not working. it pass everything :slight\_smile: it worked when i was only one condition. 1 ) doesnt work -\> if \[logid\] == "%…

---

## [Dec 6th, 2020: \[EN\] Uploading data from OSM into Elasticsearch](https://discuss.elastic.co/t/dec-6th-2020-en-uploading-data-from-osm-into-elasticsearch/255059)

<div class="topic-metadata">

**Author:** [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Replies:** 0\
**Last updated:** [December 6, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2020-en-uploading-data-from-osm-into-elasticsearch/255059 "2020-12-06T08:00:06Z")

</div>

Spanish version One of the most common issues for Elastic stack users that deal with geospatial data is how to upload geospatial data users is how to ingest data in Elasticsearch. You can check Kibana 7.10 docs to learn…

---

## [Dec 18th, 2019: \[EN\]\[Elastic Stack\] Monitoring your home network with the Elastic Stack](https://discuss.elastic.co/t/dec-18th-2019-en-elastic-stack-monitoring-your-home-network-with-the-elastic-stack/211453)

<div class="topic-metadata">

**Author:** [@Paul\_Coghlan](https://discuss.elastic.co/u/Paul_Coghlan)\
**Replies:** 0\
**Last updated:** [December 18, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-18th-2019-en-elastic-stack-monitoring-your-home-network-with-the-elastic-stack/211453 "2019-12-18T08:00:12Z")

</div>

Why add a home router? There are lots of good reasons to take control and start using your own home router: You can add best-of-breed network and security features that are not always available in consumer modem router…

---

## [How to find elastic search version?](https://discuss.elastic.co/t/how-to-find-elastic-search-version/8737)

<div class="topic-metadata">

**Author:** [@kiruba\_2](https://discuss.elastic.co/u/kiruba_2)\
**Replies:** 3\
**Last updated:** [April 1, 2015, 9:43pm UTC](https://discuss.elastic.co/t/how-to-find-elastic-search-version/8737 "2015-04-01T21:43:57Z")

</div>

Hello all, I have a doubt about to find elasticsearch version in linux. Thanks. --

---

## [Visualize: JSON Input: how to use?](https://discuss.elastic.co/t/visualize-json-input-how-to-use/75513)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 2\
**Last updated:** [February 20, 2017, 7:49am UTC](https://discuss.elastic.co/t/visualize-json-input-how-to-use/75513 "2017-02-20T07:49:59Z")

</div>

Hi, I am on kibana 5.1.2. I have some a field, which shows bytes, but I would like to convert it in an aggregation to MB. I found out how to do it with scripted fields, but now my question is, can I do this with JSON …

---

## [Help Promoting Your Talk or Meetup Group](https://discuss.elastic.co/t/help-promoting-your-talk-or-meetup-group/1305)

<div class="topic-metadata">

**Author:** [@Leslie\_Hawthorn](https://discuss.elastic.co/u/Leslie_Hawthorn)\
**Replies:** 0\
**Last updated:** [May 26, 2015, 11:13am UTC](https://discuss.elastic.co/t/help-promoting-your-talk-or-meetup-group/1305 "2015-05-26T11:13:57Z")

</div>

If you're convening a meetup about the Elastic Stack, we would love to hear from you. Please let us know about the meetup and we will happily promote it in our newsletters, on our blog, via email to our contacts database…

---

## [Dec 15th, 2021: \[en\] UFOs in Kibana Maps](https://discuss.elastic.co/t/dec-15th-2021-en-ufos-in-kibana-maps/290576)

<div class="topic-metadata">

**Author:** [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Replies:** 0\
**Last updated:** [December 15, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-15th-2021-en-ufos-in-kibana-maps/290576 "2021-12-15T08:00:52Z")

</div>

When the call came for doing a post for the advent calendar, I signed up to write about our amazing maps capabilities in Kibana again. But, in my end-of-year escapism from real and scary things like covid and climate em…

---

## [License not available](https://discuss.elastic.co/t/license-not-available/265931)

<div class="topic-metadata">

**Author:** [@hayo](https://discuss.elastic.co/u/hayo)\
**Replies:** 1\
**Last updated:** [March 2, 2021, 10:17am UTC](https://discuss.elastic.co/t/license-not-available/265931 "2021-03-02T10:17:33Z")

</div>

Hello, I just updated from 7.10.2 to 7.11.1, however when we try to access kibana, we get back: {"statusCode":503,"error":"Service Unavailable","message":"License is not available."} We host the whole ELK stack on the…

---

## [Get index pattern ID?](https://discuss.elastic.co/t/get-index-pattern-id/132598)

<div class="topic-metadata">

**Author:** [@sdndude](https://discuss.elastic.co/u/sdndude)\
**Replies:** 2\
**Last updated:** [May 24, 2018, 5:01pm UTC](https://discuss.elastic.co/t/get-index-pattern-id/132598 "2018-05-24T17:01:54Z")

</div>

Is there an API to get the index pattern IDs? I had to delete the index pattern that I had because the mappings changed and now none of my visualizations work. I would hate to have to re-create them when I can just edi…

---

## [Add a filter to query\_suggestion](https://discuss.elastic.co/t/add-a-filter-to-query-suggestion/258932)

<div class="topic-metadata">

**Author:** [@andante](https://discuss.elastic.co/u/andante)\
**Replies:** 2\
**Last updated:** [December 17, 2020, 8:46pm UTC](https://discuss.elastic.co/t/add-a-filter-to-query-suggestion/258932 "2020-12-17T20:46:37Z")

</div>

A follow on from: How to add filter in "query suggestion" feature Hi team, I've run into the issue mentioned in the above query today, and was wondering if there was anything on the roadmap to allow filtering when doin…

[Previous page](https://discuss.elastic.co/top.md?page=252&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=254&per_page=50&period=all)
