# Top

**URL:** https://discuss.elastic.co/top.md?page=280&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 281

---

## [Find Duplicate records in data](https://discuss.elastic.co/t/find-duplicate-records-in-data/42893)

<div class="topic-metadata">

**Author:** [@mr\_search](https://discuss.elastic.co/u/mr_search)\
**Replies:** 6\
**Last updated:** [February 26, 2016, 10:00pm UTC](https://discuss.elastic.co/t/find-duplicate-records-in-data/42893 "2016-02-26T22:00:08Z")

</div>

I have database of 100 thousands persons record. I need to find duplicate records using different matching fields. currently i can figure out duplicate records using dedup query, that is limited to only only field. …

---

## [Dissect Parsing Error with Sonicwall Module \[Filebeat 7.9.2\]](https://discuss.elastic.co/t/dissect-parsing-error-with-sonicwall-module-filebeat-7-9-2/264011)

<div class="topic-metadata">

**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\
**Replies:** 2\
**Last updated:** [February 17, 2021, 6:54am UTC](https://discuss.elastic.co/t/dissect-parsing-error-with-sonicwall-module-filebeat-7-9-2/264011 "2021-02-17T06:54:58Z")

</div>

Hi, everyone I have found some dissect parsing errors by using Sonicwall module module of Filebeat 7.9.2. Here you are some examples: Feb 11 07:31:35 \_gateway id=firewall sn=\<serial-number\> time="2021-02-11 06:31:35 …

---

## [Negative free swap space size](https://discuss.elastic.co/t/negative-free-swap-space-size/242626)

<div class="topic-metadata">

**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\
**Replies:** 3\
**Last updated:** [August 20, 2020, 3:45am UTC](https://discuss.elastic.co/t/negative-free-swap-space-size/242626 "2020-08-20T03:45:22Z")

</div>

I installed ES 7.8.0 to my local kubernetes cluster using the helm chart into my docker-for-windows and WSL2. I'm seeing this error message in my logs constantly. {"type": "server", "timestamp": "2020-07-26T03:23:47,931…

---

## [Elasticsearch as Tile Server](https://discuss.elastic.co/t/elasticsearch-as-tile-server/226610)

<div class="topic-metadata">

**Author:** [@Nishant\_Gauttam](https://discuss.elastic.co/u/Nishant_Gauttam)\
**Replies:** 1\
**Last updated:** [April 7, 2020, 12:00am UTC](https://discuss.elastic.co/t/elasticsearch-as-tile-server/226610 "2020-04-07T00:00:22Z")

</div>

I have looked at creating dynamic data MVT tile servers from POSTGIS using ST\_AsMVT & ST\_AsMVTGeom functions. Elastic search supports tiling , tile grid aggregation , vector layers. My data is more suitable to be stor…

---

## [Maximum Shard Size in ElasticSearch](https://discuss.elastic.co/t/maximum-shard-size-in-elasticsearch/35202)

<div class="topic-metadata">

**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\
**Replies:** 1\
**Last updated:** [November 21, 2015, 5:38am UTC](https://discuss.elastic.co/t/maximum-shard-size-in-elasticsearch/35202 "2015-11-21T05:38:06Z")

</div>

What is the maximum recommended shard size in elasticsearch? I have gone through this blog and this discussion. It seems maximum shard size per index should be less than equal to the amount memory allocated to ES. For…

---

## [Query with today date](https://discuss.elastic.co/t/query-with-today-date/165572)

<div class="topic-metadata">

**Author:** [@Michel](https://discuss.elastic.co/u/Michel)\
**Replies:** 4\
**Last updated:** [January 25, 2019, 12:47pm UTC](https://discuss.elastic.co/t/query-with-today-date/165572 "2019-01-25T12:47:14Z")

</div>

Hello, I want to search on a date area to extract the data of the day from 7 hours, I hard coded, but I would like the day depends on the date I do the extraction , Thank you for your help. GET /\_search { "query": { …

---

## [Node.max\_local\_storage\_nodes error ruuning elasticsearch](https://discuss.elastic.co/t/node-max-local-storage-nodes-error-ruuning-elasticsearch/93931)

<div class="topic-metadata">

**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\
**Replies:** 2\
**Last updated:** [July 20, 2017, 1:40pm UTC](https://discuss.elastic.co/t/node-max-local-storage-nodes-error-ruuning-elasticsearch/93931 "2017-07-20T13:40:50Z")

</div>

i installed elasticsearch5.5.0 ,i did run it and evrything was ok i did't change anything about its configuration but i rerun it and something is wrong ,this error apeared to me ,i don(t know how to fix it \[WARN \]\[o.…

---

## [Understanding the \_status response: \_shards](https://discuss.elastic.co/t/understanding-the--status-response--shards/3716)

<div class="topic-metadata">

**Author:** [@harryf](https://discuss.elastic.co/u/harryf)\
**Replies:** 5\
**Last updated:** [January 3, 2011, 9:59am UTC](https://discuss.elastic.co/t/understanding-the--status-response--shards/3716 "2011-01-03T09:59:23Z")

</div>

Trying to understand what the \_status response for an index is really telling me, specifically the \_shards node; "\_shards":{"total":10,"successful":5,"failed":0} ...this is from an index running on just one node w…

---

## [Processor \[drop\_event\] not dropping events](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events/72186)

<div class="topic-metadata">

**Author:** [@RedNickelPython](https://discuss.elastic.co/u/RedNickelPython)\
**Replies:** 8\
**Last updated:** [January 19, 2017, 8:34pm UTC](https://discuss.elastic.co/t/processor-drop-event-not-dropping-events/72186 "2017-01-19T20:34:47Z")

</div>

ver 5.1.1 I have the below implemented to drop windows events not needed, but am still getting events that should be blocked. I had previously tried processors: - drop\_event: when: not: equals: …

---

## [How to make Kibana Dashboard auto-refresh data by default](https://discuss.elastic.co/t/how-to-make-kibana-dashboard-auto-refresh-data-by-default/230293)

<div class="topic-metadata">

**Author:** [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\
**Replies:** 6\
**Last updated:** [May 20, 2020, 3:29am UTC](https://discuss.elastic.co/t/how-to-make-kibana-dashboard-auto-refresh-data-by-default/230293 "2020-05-20T03:29:34Z")

</div>

Hi, Is there any way to configure auto-refresh settings by default for a Kibana Dashboard. I want to make following is the default configuration of my dashboard. Appreciate any response on this. Tried to save dashboa…

---

## [Paginating result set greater than 10000 (with aggregations) - Possible options](https://discuss.elastic.co/t/paginating-result-set-greater-than-10000-with-aggregations-possible-options/119673)

<div class="topic-metadata">

**Author:** [@ParitoshBh](https://discuss.elastic.co/u/ParitoshBh)\
**Replies:** 6\
**Last updated:** [February 23, 2018, 4:11pm UTC](https://discuss.elastic.co/t/paginating-result-set-greater-than-10000-with-aggregations-possible-options/119673 "2018-02-23T16:11:30Z")

</div>

My use case in this regard is pretty simple, I am running a query, with aggregations, which returns result \> 10000 documents. For navigating this result set I am using from and retrieving documents in batches of 20. Eve…

---

## [Elastic Memory:Storage Ratio / Hot-warm](https://discuss.elastic.co/t/elastic-memory-storage-ratio-hot-warm/246389)

<div class="topic-metadata">

**Author:** [@skysbsb](https://discuss.elastic.co/u/skysbsb)\
**Replies:** 2\
**Last updated:** [August 26, 2020, 3:48pm UTC](https://discuss.elastic.co/t/elastic-memory-storage-ratio-hot-warm/246389 "2020-08-26T15:48:55Z")

</div>

I am setting up a cluster with the Elasticsearch BASIC version and one question I have is related to the memory: storage ratio. I saw in a webinar (https://www.elastic.co/pdf/elasticsearch-sizing-and-capacity-planning…

---

## [SSL config to ignore validation](https://discuss.elastic.co/t/ssl-config-to-ignore-validation/119551)

<div class="topic-metadata">

**Author:** [@GSCully](https://discuss.elastic.co/u/GSCully)\
**Replies:** 5\
**Last updated:** [February 14, 2018, 6:18pm UTC](https://discuss.elastic.co/t/ssl-config-to-ignore-validation/119551 "2018-02-14T18:18:05Z")

</div>

I want to encrypt the data from Filebeat to Logstash using SSL but I don't want to enforce validating the certificate. Is that possible? I am trying to avoid generating/buying a ssl for each filebeat host. If I remove t…

---

## [Kibana not fetching indices that are present in elasticsearch](https://discuss.elastic.co/t/kibana-not-fetching-indices-that-are-present-in-elasticsearch/70671)

<div class="topic-metadata">

**Author:** [@poonia](https://discuss.elastic.co/u/poonia)\
**Replies:** 5\
**Last updated:** [January 9, 2017, 4:21pm UTC](https://discuss.elastic.co/t/kibana-not-fetching-indices-that-are-present-in-elasticsearch/70671 "2017-01-09T16:21:20Z")

</div>

I am using Elasticsearch 5.1.1 Kibana 5.1.1 along with x-pack. I am moving data from postgresql to elasticsearch via logstash. The data is coming to elasticsearch as I can see the index and number of documents in elastic…

---

## [Cannot setup kibana dashboards](https://discuss.elastic.co/t/cannot-setup-kibana-dashboards/121939)

<div class="topic-metadata">

**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\
**Replies:** 2\
**Last updated:** [March 1, 2018, 4:13pm UTC](https://discuss.elastic.co/t/cannot-setup-kibana-dashboards/121939 "2018-03-01T16:13:11Z")

</div>

I have the following set in my metricbeat.yml setup.kibana: host: "localhost:5601" protocol: "https" ssl.enabled: true ssl.certificate\_authorities: \[ "/etc/opt/zookeeper/MyCorporateCA.pem" \] ssl.verification\_m…

---

## [How to get array size for each document](https://discuss.elastic.co/t/how-to-get-array-size-for-each-document/226599)

<div class="topic-metadata">

**Author:** [@ntsh999](https://discuss.elastic.co/u/ntsh999)\
**Replies:** 2\
**Last updated:** [April 6, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-get-array-size-for-each-document/226599 "2020-04-06T08:01:25Z")

</div>

I want the size of an array of objects ('breaches' here) which is present in each document to be returned along with the fields present in the document once the query is executed. How can I do this? Below is my document …

---

## [Problems connecting to existing ElasticSearch instance in a spring boot application](https://discuss.elastic.co/t/problems-connecting-to-existing-elasticsearch-instance-in-a-spring-boot-application/43805)

<div class="topic-metadata">

**Author:** [@SKing](https://discuss.elastic.co/u/SKing)\
**Replies:** 6\
**Last updated:** [January 3, 2017, 1:43pm UTC](https://discuss.elastic.co/t/problems-connecting-to-existing-elasticsearch-instance-in-a-spring-boot-application/43805 "2017-01-03T13:43:46Z")

</div>

I have an elasticsearch instance running locally. I have a spring boot application. In my application I have a service ServiceX which contains an elasticsearch repository which extends ElasticsearchRepository. So Service…

---

## [Reveal, a Logstash plugin for robot detection and traffic intelligence](https://discuss.elastic.co/t/reveal-a-logstash-plugin-for-robot-detection-and-traffic-intelligence/98573)

<div class="topic-metadata">

**Author:** [@znarf](https://discuss.elastic.co/u/znarf)\
**Replies:** 0\
**Last updated:** [August 28, 2017, 2:01pm UTC](https://discuss.elastic.co/t/reveal-a-logstash-plugin-for-robot-detection-and-traffic-intelligence/98573 "2017-08-28T14:01:56Z")

</div>

Hi everyone, At Access Watch, we released last week Reveal, a new product that bring robot detection and traffic intelligence to your log pipeline. I’m super happy to share with you that Reveal is now available as a Log…

---

## [Elasticsearch Compression ratio](https://discuss.elastic.co/t/elasticsearch-compression-ratio/93424)

<div class="topic-metadata">

**Author:** [@hossein\_ey](https://discuss.elastic.co/u/hossein_ey)\
**Replies:** 5\
**Last updated:** [July 18, 2017, 6:59am UTC](https://discuss.elastic.co/t/elasticsearch-compression-ratio/93424 "2017-07-18T06:59:24Z")

</div>

we want to use Elasticsearch for a large amount of data. one of the important issue is storage usage. we create a sample index with 412 million 412 million rows take 242 GB of hard ===\> 590 Bytes for each row we kn…

---

## [Rejecting mapping update to \[test\] as the final mapping would have more than 1 type: \[type1, doc\]](https://discuss.elastic.co/t/rejecting-mapping-update-to-test-as-the-final-mapping-would-have-more-than-1-type-type1-doc/110997)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 8\
**Last updated:** [December 11, 2017, 8:30pm UTC](https://discuss.elastic.co/t/rejecting-mapping-update-to-test-as-the-final-mapping-would-have-more-than-1-type-type1-doc/110997 "2017-12-11T20:30:07Z")

</div>

Hello, I'm following Removal of mapping types | Elasticsearch Reference \[6.0\] | Elastic, by creating new index with single type of document and trying to perform \_reindex: My elasticsearch has index with \_type: type1 a…

---

## [Logstash filter fields in if conditions](https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717)

<div class="topic-metadata">

**Author:** [@vape](https://discuss.elastic.co/u/vape)\
**Replies:** 4\
**Last updated:** [July 28, 2020, 5:38am UTC](https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717 "2020-07-28T05:38:26Z")

</div>

Hello, I am learning about logstash, esspecially about logstash filter with if condition. Something not clear to me is what are those fields used in if condition? How can I get the list of those fields? For example, I …

---

## [Performance: Calculations inside query, ES vs Mysql](https://discuss.elastic.co/t/performance-calculations-inside-query-es-vs-mysql/37911)

<div class="topic-metadata">

**Author:** [@bibinvenugopal](https://discuss.elastic.co/u/bibinvenugopal)\
**Replies:** 3\
**Last updated:** [December 24, 2015, 5:11pm UTC](https://discuss.elastic.co/t/performance-calculations-inside-query-es-vs-mysql/37911 "2015-12-24T17:11:22Z")

</div>

Calculation in select query which is faster, mysql or elastic search? { "query" : { ... }, "script\_fields" : { "gross\_profit" : { script: "((((doc\['price\_…

---

## [Logstash own debugging logs location?](https://discuss.elastic.co/t/logstash-own-debugging-logs-location/44404)

<div class="topic-metadata">

**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\
**Replies:** 8\
**Last updated:** [March 16, 2016, 5:24am UTC](https://discuss.elastic.co/t/logstash-own-debugging-logs-location/44404 "2016-03-16T05:24:45Z")

</div>

Hi, I am trying to debug logstash; therefore, I need it's debug logs but couldn't find any. In fact, I moved the ELK stack from one Windows box to another. Obviously, version has also changed. Before I was using logsta…

---

## [Grok Custom pattern file](https://discuss.elastic.co/t/grok-custom-pattern-file/118267)

<div class="topic-metadata">

**Author:** [@Gabriel\_Pellegrini\_M](https://discuss.elastic.co/u/Gabriel_Pellegrini_M)\
**Replies:** 6\
**Last updated:** [February 5, 2018, 4:00pm UTC](https://discuss.elastic.co/t/grok-custom-pattern-file/118267 "2018-02-05T16:00:21Z")

</div>

Hi guys, I'm starting in logstash's world and i'm having a problem to set more than one custom grok pattern into a "patern\_dir" I've created a file into my directory "/etc/logstash/pattern" with the follow information …

---

## [How to setup logstash cluster](https://discuss.elastic.co/t/how-to-setup-logstash-cluster/90403)

<div class="topic-metadata">

**Author:** [@Dheergudi](https://discuss.elastic.co/u/Dheergudi)\
**Replies:** 6\
**Last updated:** [June 27, 2017, 6:01am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-cluster/90403 "2017-06-27T06:01:57Z")

</div>

Hi there, I need help with setting up logstash cluster, I have one node for logstash I need to make It 2 or more node cluster.

---

## [Update existing values within a list or array in Elastic Search](https://discuss.elastic.co/t/update-existing-values-within-a-list-or-array-in-elastic-search/18279)

<div class="topic-metadata">

**Author:** [@Madhumita\_Sadhukhan](https://discuss.elastic.co/u/Madhumita_Sadhukhan)\
**Replies:** 6\
**Last updated:** [October 10, 2014, 1:26pm UTC](https://discuss.elastic.co/t/update-existing-values-within-a-list-or-array-in-elastic-search/18279 "2014-10-10T13:26:44Z")

</div>

I have a requirement where I need to update(not append) existing values within a list or array in Elastic Search. Is this feature supported in elastic search? For eg: I have a field called jobs as part of my doc…

---

## [FATAL Error: Index .kibana belongs to a version of Kibana that cannot be automatically migrated. Reset it or use the X-Pack upgrade assistant](https://discuss.elastic.co/t/fatal-error-index-kibana-belongs-to-a-version-of-kibana-that-cannot-be-automatically-migrated-reset-it-or-use-the-x-pack-upgrade-assistant/199948)

<div class="topic-metadata">

**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\
**Replies:** 1\
**Last updated:** [September 18, 2019, 8:41am UTC](https://discuss.elastic.co/t/fatal-error-index-kibana-belongs-to-a-version-of-kibana-that-cannot-be-automatically-migrated-reset-it-or-use-the-x-pack-upgrade-assistant/199948 "2019-09-18T08:41:20Z")

</div>

I have installed elasticsearch cluster on a Linux server. Initially I installed Elasticsearch 7.x (but then changed the elasticsearch to 6.8). Elasticsearch is running fine. I did the same with Kibana on a Windows Serve…

---

## [Convert String to timestamp example](https://discuss.elastic.co/t/convert-string-to-timestamp-example/80856)

<div class="topic-metadata">

**Author:** [@cabishek188](https://discuss.elastic.co/u/cabishek188)\
**Replies:** 6\
**Last updated:** [March 31, 2017, 8:36pm UTC](https://discuss.elastic.co/t/convert-string-to-timestamp-example/80856 "2017-03-31T20:36:23Z")

</div>

Hi all, I want to convert a String to be used in addition to @timestamp. Please help me as to how I do it. I used the "date" filter as mentioned in lot of posts but was unable to get it working. My message: message…

---

## [Port required for filebeat agent](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083)

<div class="topic-metadata">

**Author:** [@priti](https://discuss.elastic.co/u/priti)\
**Replies:** 4\
**Last updated:** [May 17, 2018, 7:18am UTC](https://discuss.elastic.co/t/port-required-for-filebeat-agent/132083 "2018-05-17T07:18:47Z")

</div>

We have planning to deploy Filebeat agent for log monitoring but need some information. If i have to transfer log data beat to logstash , which port needs to be open on application server where log present? If i have t…

---

## [Can't save Search and Visualization in kibana](https://discuss.elastic.co/t/cant-save-search-and-visualization-in-kibana/188903)

<div class="topic-metadata">

**Author:** [@Sam\_K](https://discuss.elastic.co/u/Sam_K)\
**Replies:** 2\
**Last updated:** [July 5, 2019, 7:10am UTC](https://discuss.elastic.co/t/cant-save-search-and-visualization-in-kibana/188903 "2019-07-05T07:10:31Z")

</div>

I cannot save searches and visualizations in Kibana because a forbidden error has occured. Please let me know how to resolve. elasticsearch, kibana : 6.5.4

---

## [Search a PDF file using its content](https://discuss.elastic.co/t/search-a-pdf-file-using-its-content/164024)

<div class="topic-metadata">

**Author:** [@Mani\_Sundharram](https://discuss.elastic.co/u/Mani_Sundharram)\
**Replies:** 8\
**Last updated:** [January 14, 2019, 3:48am UTC](https://discuss.elastic.co/t/search-a-pdf-file-using-its-content/164024 "2019-01-14T03:48:21Z")

</div>

Hi, I have installed and setup elastic search and ingest-attachment plugin. I need to search through a list of pdf files (20000) given in a file path how would I do. How do you push the data to the elastic search , i…

---

## [Maximum number of fields in an index mapping](https://discuss.elastic.co/t/maximum-number-of-fields-in-an-index-mapping/90150)

<div class="topic-metadata">

**Author:** [@uday](https://discuss.elastic.co/u/uday)\
**Replies:** 2\
**Last updated:** [June 22, 2017, 5:04pm UTC](https://discuss.elastic.co/t/maximum-number-of-fields-in-an-index-mapping/90150 "2017-06-22T17:04:40Z")

</div>

Hi, We are using Elasticsearch 2.3. In this version, there is no limit on the maximum number of fields in an index mapping but the recommended limit is 1000 on ES 5. We want to know the reason behind it. We already hav…

---

## [Painless test on Array length](https://discuss.elastic.co/t/painless-test-on-array-length/116494)

<div class="topic-metadata">

**Author:** [@sgruhier](https://discuss.elastic.co/u/sgruhier)\
**Replies:** 5\
**Last updated:** [January 23, 2018, 5:29pm UTC](https://discuss.elastic.co/t/painless-test-on-array-length/116494 "2018-01-23T17:29:17Z")

</div>

Hi, I'm trying to display only documents with more than one value in an array. My naïve approach was to do { "query": { "bool": { "must": { "script": { …

---

## [\[ 4.3.0 \] how to configure your nginx balancer and apache reverse proxy](https://discuss.elastic.co/t/4-3-0-how-to-configure-your-nginx-balancer-and-apache-reverse-proxy/37351)

<div class="topic-metadata">

**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\
**Replies:** 5\
**Last updated:** [February 23, 2016, 2:47pm UTC](https://discuss.elastic.co/t/4-3-0-how-to-configure-your-nginx-balancer-and-apache-reverse-proxy/37351 "2016-02-23T14:47:18Z")

</div>

problem solved. solution below the question. could someone please help me reconfigure my nginx balancer? i have 3 elk nodes behind a UDP/TCP balancer (round-robin). |----------------| …

---

## [Getting "event\_agent\_id\_status auth\_metadata\_missing" error while sending logs from standalone elasticagent](https://discuss.elastic.co/t/getting-event-agent-id-status-auth-metadata-missing-error-while-sending-logs-from-standalone-elasticagent/324378)

<div class="topic-metadata">

**Author:** [@Bhrugu\_Sharma](https://discuss.elastic.co/u/Bhrugu_Sharma)\
**Replies:** 0\
**Last updated:** [February 1, 2023, 2:06am UTC](https://discuss.elastic.co/t/getting-event-agent-id-status-auth-metadata-missing-error-while-sending-logs-from-standalone-elasticagent/324378 "2023-02-01T02:06:18Z")

</div>

I am trying to send the logs from my AKS cluster into Elasticsearch the log that I am getting is "event.agent\_id\_status auth\_metadata\_missing" in my kibana even after all the volume mounts are done correctly here's my …

---

## [ILM setup dynamic alias in filebeat](https://discuss.elastic.co/t/ilm-setup-dynamic-alias-in-filebeat/187298)

<div class="topic-metadata">

**Author:** [@TanguyB](https://discuss.elastic.co/u/TanguyB)\
**Replies:** 1\
**Last updated:** [June 28, 2019, 9:07pm UTC](https://discuss.elastic.co/t/ilm-setup-dynamic-alias-in-filebeat/187298 "2019-06-28T21:07:51Z")

</div>

Hello, I'm trying to setup ILM in my filebeat.yml and I want to use dynamic index My index is set to: index: "filebeat-%{\[agent.version\]}-%{\[fileset.module\]}-%{+yyyy.MM.dd}" which mean I'll have different index per f…

---

## [Failed to retrieve password hash for reserved user \[kibana\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592)

<div class="topic-metadata">

**Author:** [@niudaye123](https://discuss.elastic.co/u/niudaye123)\
**Replies:** 6\
**Last updated:** [August 6, 2019, 5:35pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana/193592 "2019-08-06T17:35:38Z")

</div>

I have to repurpose all the nodes in my cluster, during that process I accidentally deleted the \_security index which is for built in user information. Now in the log it said failed to retrieve password hash for reserved…

---

## [Index lifecycle management for existing indices?](https://discuss.elastic.co/t/index-lifecycle-management-for-existing-indices/181749)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 4\
**Last updated:** [June 3, 2019, 4:41pm UTC](https://discuss.elastic.co/t/index-lifecycle-management-for-existing-indices/181749 "2019-06-03T16:41:44Z")

</div>

Hi all, I am currently checking out the index lifecycle management in 6.6.2. As I understand the docs I can add a policy to an index at index creation or indirectly by an index template. How can I add / update to an …

---

## [How to fix ui settings status to green and plugin:elasticsearch@5.0.1\] Status changed from yellow to red - Authentication Exception](https://discuss.elastic.co/t/how-to-fix-ui-settings-status-to-green-and-plugin-elasticsearch-5-0-1-status-changed-from-yellow-to-red-authentication-exception/69110)

<div class="topic-metadata">

**Author:** [@Sanjay1](https://discuss.elastic.co/u/Sanjay1)\
**Replies:** 2\
**Last updated:** [December 15, 2016, 3:55pm UTC](https://discuss.elastic.co/t/how-to-fix-ui-settings-status-to-green-and-plugin-elasticsearch-5-0-1-status-changed-from-yellow-to-red-authentication-exception/69110 "2016-12-15T15:55:38Z")

</div>

We are getting following error in kibana log file, how to fix those errors. log \[04:28:49.556\] \[error\]\[status\]\[plugin:xpack\_main@5.0.1\] Status changed from yellow to red - Authentication Exception log \[04:28:49.558…

---

## [Mapper Parsing Exception in elasticsearch](https://discuss.elastic.co/t/mapper-parsing-exception-in-elasticsearch/32825)

<div class="topic-metadata">

**Author:** [@Tarneet\_Singh](https://discuss.elastic.co/u/Tarneet_Singh)\
**Replies:** 8\
**Last updated:** [October 23, 2015, 10:48am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-in-elasticsearch/32825 "2015-10-23T10:48:27Z")

</div>

i have installed the mapper attachment plugin successfully.i am using Elasticsearch - 1.7.3 and mapper attachment - 2.7.1. i want to use attachments for searching purpose. with the help of this link https://github.com/el…

---

## [Add field with timestamp in documents](https://discuss.elastic.co/t/add-field-with-timestamp-in-documents/25814)

<div class="topic-metadata">

**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\
**Replies:** 3\
**Last updated:** [July 20, 2015, 6:56pm UTC](https://discuss.elastic.co/t/add-field-with-timestamp-in-documents/25814 "2015-07-20T18:56:57Z")

</div>

Hi!!! I've created index: PUT 'http://localhost:9200/twitter/ and i want that my index add automaticly @timestamp field to all my documents when indexing. What should I do? THX for helping me.

---

## [Logstash logs :sql\_last\_value in local timezone, making fresh db records lookup unfeasible](https://discuss.elastic.co/t/logstash-logs-sql-last-value-in-local-timezone-making-fresh-db-records-lookup-unfeasible/140597)

<div class="topic-metadata">

**Author:** [@Jevgenij](https://discuss.elastic.co/u/Jevgenij)\
**Replies:** 8\
**Last updated:** [July 31, 2018, 3:16pm UTC](https://discuss.elastic.co/t/logstash-logs-sql-last-value-in-local-timezone-making-fresh-db-records-lookup-unfeasible/140597 "2018-07-31T15:16:30Z")

</div>

Hello! My goal is to set up continuous data migration from MySQL to Elasticsearch. I've got stuck with :sql\_last\_value. Logstash logs it in local timezone, so next time it queries db, :sql\_last\_value value is wrong. M…

---

## [Node settings must not contain any index level setting](https://discuss.elastic.co/t/node-settings-must-not-contain-any-index-level-setting/109573)

<div class="topic-metadata">

**Author:** [@surendran](https://discuss.elastic.co/u/surendran)\
**Replies:** 5\
**Last updated:** [November 29, 2017, 1:06pm UTC](https://discuss.elastic.co/t/node-settings-must-not-contain-any-index-level-setting/109573 "2017-11-29T13:06:41Z")

</div>

\[2017-11-29T10:53:34,618\]\[ERROR\]\[o.e.b.Bootstrap \] Exception java.lang.IllegalArgumentException: node settings must not contain any index level settings at org.elasticsearch.common.settings.SettingsModule.(Set…

---

## [Logstash if statement with regex example](https://discuss.elastic.co/t/logstash-if-statement-with-regex-example/75706)

<div class="topic-metadata">

**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\
**Replies:** 6\
**Last updated:** [February 21, 2017, 8:32am UTC](https://discuss.elastic.co/t/logstash-if-statement-with-regex-example/75706 "2017-02-21T08:32:35Z")

</div>

Can anyone show me how an if statement with a regex look like in logstash? my statement s if \[fieldname\] =~ /^\[0-9\]\*$/ if \[fieldname\] =~ "^\[0-9\]\*$" does not work What I intend to do is to check if the "fieldname" con…

---

## [\[ANNOUNCEMENT\] - FSCrawler 2.7 released](https://discuss.elastic.co/t/announcement-fscrawler-2-7-released/280525)

<div class="topic-metadata">

**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Replies:** 0\
**Last updated:** [August 5, 2021, 11:16am UTC](https://discuss.elastic.co/t/announcement-fscrawler-2-7-released/280525 "2021-08-05T11:16:24Z")

</div>

The FSCrawler team is pleased to announce the FSCrawler 2.7 release! FSCrawler FS Crawler offers a simple way to index binary files into elasticsearch. Usage Download FSCrawler 2.7: wget https://repo1.maven.org/maven2…

---

## [Kibana\_task\_manager\_1 issues](https://discuss.elastic.co/t/kibana-task-manager-1-issues/222839)

<div class="topic-metadata">

**Author:** [@Cameron\_808](https://discuss.elastic.co/u/Cameron_808)\
**Replies:** 2\
**Last updated:** [March 11, 2020, 11:21pm UTC](https://discuss.elastic.co/t/kibana-task-manager-1-issues/222839 "2020-03-11T23:21:42Z")

</div>

Hello, I'm completely new to Kibana and Elasticsearch. I've been digging my heels into figuring out why my Kibana is giving me installation issues. I'm utilizing MAC OS. I installed and deleted and then re-installed …

---

## [Filebeat : "Failed to connect to backoff"](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff/155535)

<div class="topic-metadata">

**Author:** [@RogerLapin](https://discuss.elastic.co/u/RogerLapin)\
**Replies:** 3\
**Last updated:** [November 6, 2018, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff/155535 "2018-11-06T16:53:57Z")

</div>

Greetings, I have been trying to have filebeat running on a swarm cluster, with what looked like quite a basic configuration (according to me!). Using logstash's gelf driver to direct log into logstash works well. But …

---

## [Heatmap 24h - 7d](https://discuss.elastic.co/t/heatmap-24h-7d/141192)

<div class="topic-metadata">

**Author:** [@axi92](https://discuss.elastic.co/u/axi92)\
**Replies:** 2\
**Last updated:** [July 25, 2018, 12:01am UTC](https://discuss.elastic.co/t/heatmap-24h-7d/141192 "2018-07-25T00:01:25Z")

</div>

I can't get my heatmap to work. Days of Week at the X-Axis. (7 colums) Hours of the day at the Y-Axis (24) Metrics: I use Count, because I want to count how many occurrences are in one hour. It looks like this at the…

---

## [Get Current Time and date](https://discuss.elastic.co/t/get-current-time-and-date/117459)

<div class="topic-metadata">

**Author:** [@devil\_srj7](https://discuss.elastic.co/u/devil_srj7)\
**Replies:** 2\
**Last updated:** [January 29, 2018, 3:46pm UTC](https://discuss.elastic.co/t/get-current-time-and-date/117459 "2018-01-29T15:46:12Z")

</div>

I need to retrieve all the records between Start of the day to End of the day For Eg: 2018-01-29 00:00:00 - 2018-01-29 23:59:59 Similarly, I need to get current Time and Date. GET \_search { "size": 1, "script…

---

## [Dec 5th, 2020: \[FR\] Recherchez tous vos documents, n'importe où, avec Workplace Search](https://discuss.elastic.co/t/dec-5th-2020-fr-recherchez-tous-vos-documents-nimporte-ou-avec-workplace-search/254739)

<div class="topic-metadata">

**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Replies:** 0\
**Last updated:** [December 5, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-5th-2020-fr-recherchez-tous-vos-documents-nimporte-ou-avec-workplace-search/254739 "2020-12-05T08:00:03Z")

</div>

English version Introduction Vous savez déjà que Workplace Search est fourni avec beaucoup de connecteurs qui vous permettent de connecter vos sources de données de vos documents d'entreprise et de disposer ainsi d'un m…

[Previous page](https://discuss.elastic.co/top.md?page=279&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=281&per_page=50&period=all)
