# Top **URL:** https://discuss.elastic.co/top.md?page=281&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 282 --- ## [Working with strings in Painless](https://discuss.elastic.co/t/working-with-strings-in-painless/107896)
**Author:** [@merito](https://discuss.elastic.co/u/merito)\ **Replies:** 5\ **Last updated:** [November 16, 2017, 9:17pm UTC](https://discuss.elastic.co/t/working-with-strings-in-painless/107896 "2017-11-16T21:17:43Z")
Hi, I'm trying to manipulate strings doing an aggregation, but I fail. I've got a field mapped as a keyword, let's call it my\_field. There are some data like 12.0343.13, 3.253.88 in this field in docs. I try to do the a… --- ## [Palo Alto integration with USERID \[SIEM Feature\]](https://discuss.elastic.co/t/palo-alto-integration-with-userid-siem-feature/268173)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 5\ **Last updated:** [March 24, 2021, 3:13pm UTC](https://discuss.elastic.co/t/palo-alto-integration-with-userid-siem-feature/268173 "2021-03-24T15:13:57Z")
Hi, everyone I have been working with Palo Alto and Filebeat over several days. I have looked on Elastic documentation that it currently supports messages of Traffic and Threat types. Is it considered to parsing User-I… --- ## [How to parse the multiline json file through logstash](https://discuss.elastic.co/t/how-to-parse-the-multiline-json-file-through-logstash/60843)
**Author:** [@sharath3185](https://discuss.elastic.co/u/sharath3185)\ **Replies:** 6\ **Last updated:** [November 21, 2016, 12:55pm UTC](https://discuss.elastic.co/t/how-to-parse-the-multiline-json-file-through-logstash/60843 "2016-11-21T12:55:49Z")
Hi, I have a json file with below multiline json format: \[ { "status": "fail", "executiontime": 1117, "errormsg": "dummy error1", "testname": "test1", "errorcode": 0, … --- ## [How do I rotate the output log files of logstash](https://discuss.elastic.co/t/how-do-i-rotate-the-output-log-files-of-logstash/29108)
**Author:** [@achakrab22](https://discuss.elastic.co/u/achakrab22)\ **Replies:** 7\ **Last updated:** [February 14, 2017, 11:25am UTC](https://discuss.elastic.co/t/how-do-i-rotate-the-output-log-files-of-logstash/29108 "2017-02-14T11:25:04Z")
Hi I am trying to log all the logstash output including Errors /Info. What is the best recommended way? Also I want to rotate the log file. I see there is an output-\> file command supported in config. but the option max\_… --- ## [Error: 502 Response](https://discuss.elastic.co/t/error-502-response/117806)
**Author:** [@sukeshss](https://discuss.elastic.co/u/sukeshss)\ **Replies:** 8\ **Last updated:** [February 5, 2018, 4:36pm UTC](https://discuss.elastic.co/t/error-502-response/117806 "2018-02-05T16:36:08Z")
I am getting the following erro while doing wildcard search via Kibana. My index size is 73GB and Docs is 5770603. Error: 502 Response request/\<@https://search.node.com/bundles/kibana.bundle.js?v=15523:27:1911 proces… --- ## [Kibana service account not working for v8 upgrade deprecation note](https://discuss.elastic.co/t/kibana-service-account-not-working-for-v8-upgrade-deprecation-note/296125)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 4\ **Last updated:** [February 4, 2022, 9:05pm UTC](https://discuss.elastic.co/t/kibana-service-account-not-working-for-v8-upgrade-deprecation-note/296125 "2022-02-04T21:05:19Z")
We recently moved our stack to 7.17 and are working through some of the warnings in the 8.0 upgrade assistant to be ready for the new version in the future. When changing Kibana to use Elasticsearch.serviceAccountToken i… --- ## [Kibana and unknown field](https://discuss.elastic.co/t/kibana-and-unknown-field/261778)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 8\ **Last updated:** [January 22, 2021, 2:58pm UTC](https://discuss.elastic.co/t/kibana-and-unknown-field/261778 "2021-01-22T14:58:49Z")
Hi there! I created an Index Pattern ".monitoring-es\*" and I try to create a dashboard on it. I would like to use the field "index\_stats.shards.total", like in the discover : Could you please help me? Why my field… --- ## [Search / filter with wildcard](https://discuss.elastic.co/t/search-filter-with-wildcard/151814)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 5\ **Last updated:** [October 15, 2018, 1:42pm UTC](https://discuss.elastic.co/t/search-filter-with-wildcard/151814 "2018-10-15T13:42:28Z")
Hi there, I have a field payload with following value: Routing to activemq:queue:tuxedoHighPriority.vpntbm2.2?exchangePattern=InOnly&messageConverter=#ttp2ActiveMQMessageConverter I want to set a filter for "Routing t… --- ## [Pingbeat: you know, for pings](https://discuss.elastic.co/t/pingbeat-you-know-for-pings/28298)
**Author:** [@Joshua\_Rich](https://discuss.elastic.co/u/Joshua_Rich)\ **Replies:** 6\ **Last updated:** [November 23, 2016, 11:21pm UTC](https://discuss.elastic.co/t/pingbeat-you-know-for-pings/28298 "2016-11-23T23:21:44Z")
Hi all, I've created a new project, pingbeat that sends sends ICMP pings to a list of targets and stores the round trip time (RTT) in Elasticsearch (or elsewhere). It uses tatsushid/go-fastping for sending/recieving pi… --- ## [Spark SQL : How to specify a date range in WHERE clause?](https://discuss.elastic.co/t/spark-sql-how-to-specify-a-date-range-in-where-clause/47240)
**Author:** [@Preeti\_Raj\_Buchhada](https://discuss.elastic.co/u/Preeti_Raj_Buchhada)\ **Replies:** 4\ **Last updated:** [March 13, 2017, 2:43pm UTC](https://discuss.elastic.co/t/spark-sql-how-to-specify-a-date-range-in-where-clause/47240 "2017-03-13T14:43:38Z")
Hello, I've got some success working with Spark SQL CLI to access our ES data. Environment: ES: 1.3.2 es-hadoop: elasticsearch-hadoop-2.2.0 Spark: spark-1.4.1-bin-hadoop2.6 The pushdown feature is working great! Ho… --- ## [Logstash throws out 'Host name does not match the certificate subject provided by the peer' error](https://discuss.elastic.co/t/logstash-throws-out-host-name-does-not-match-the-certificate-subject-provided-by-the-peer-error/270622)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 2\ **Last updated:** [April 21, 2021, 8:11am UTC](https://discuss.elastic.co/t/logstash-throws-out-host-name-does-not-match-the-certificate-subject-provided-by-the-peer-error/270622 "2021-04-21T08:11:25Z")
Hi All, I recently installed a three-node cluster in a vagrant box to test out the security features of Elasticsearch: I followed the guides in the below order: Set up basic security for the Elastic Stack | Elasticse… --- ## [Apply a simple math operation to count result](https://discuss.elastic.co/t/apply-a-simple-math-operation-to-count-result/23817)
**Author:** [@adrianlzt](https://discuss.elastic.co/u/adrianlzt)\ **Replies:** 7\ **Last updated:** [June 25, 2015, 12:46pm UTC](https://discuss.elastic.co/t/apply-a-simple-math-operation-to-count-result/23817 "2015-06-25T12:46:15Z")
I have created a new visualization with the number of requests for an Apache log. Y-Axis: Count X-Axis: Date Histogram using timestamp field and interval set to Hourly. This shows the total number of events of every ho… --- ## [\[Errno 111\] Connection refused)](https://discuss.elastic.co/t/errno-111-connection-refused/253813)
**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\ **Replies:** 5\ **Last updated:** [November 7, 2020, 7:27pm UTC](https://discuss.elastic.co/t/errno-111-connection-refused/253813 "2020-11-07T19:27:26Z")
During handling of the above exception, another exception occurred: Traceback (most recent call last): File "for\_bulk\_insert.py", line 61, in es.indices.delete(index=index\_name, ignore=\[400, 404\]) File "/home/subham… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/57377)
**Author:** [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)\ **Replies:** 5\ **Last updated:** [August 5, 2016, 7:14pm UTC](https://discuss.elastic.co/t/how-to-join-two-index/57377 "2016-08-05T19:14:37Z")
I have two index, I want to join them both. How to do that? for Ex: Emp is an one index with department id Department is other index with details and index id as department id. I want to join both index with departme… --- ## [Convert JSON Object to string](https://discuss.elastic.co/t/convert-json-object-to-string/72952)
**Author:** [@patrick.wall](https://discuss.elastic.co/u/patrick.wall)\ **Replies:** 2\ **Last updated:** [January 26, 2017, 9:42pm UTC](https://discuss.elastic.co/t/convert-json-object-to-string/72952 "2017-01-26T21:42:37Z")
Hi All, I am struggling to grasp something here. My use case is this - i am using logstash and elasticsearch to log every request that comes through my API. Whenever my api processes a request, I log the headers, and t… --- ## [ElasticSearch 5.0 PHP msearch](https://discuss.elastic.co/t/elasticsearch-5-0-php-msearch/66716)
**Author:** [@svarup](https://discuss.elastic.co/u/svarup)\ **Replies:** 3\ **Last updated:** [November 21, 2016, 5:20pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-php-msearch/66716 "2016-11-21T17:20:54Z")
How to fire multiple queries in elasticsearch using PHP. I can't find any example of msearch in php so anyone can help me how to use msearch. --- ## [ES node killed with 6/ABRT - how to find out why and by whom?](https://discuss.elastic.co/t/es-node-killed-with-6-abrt-how-to-find-out-why-and-by-whom/24108)
**Author:** [@igor\_k](https://discuss.elastic.co/u/igor_k)\ **Replies:** 6\ **Last updated:** [March 18, 2016, 10:06pm UTC](https://discuss.elastic.co/t/es-node-killed-with-6-abrt-how-to-find-out-why-and-by-whom/24108 "2016-03-18T22:06:51Z")
Hi Elasticsearch Community, One of the nodes in our cluster got restarted recently. There is no info in the logs, just this. These are the first three lines for that day: \[2015-06-21 09:21:27,753\]\[INFO \]\[node … --- ## [Filebeat is not logging anything](https://discuss.elastic.co/t/filebeat-is-not-logging-anything/59911)
**Author:** [@sgoetz](https://discuss.elastic.co/u/sgoetz)\ **Replies:** 8\ **Last updated:** [September 8, 2016, 9:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-logging-anything/59911 "2016-09-08T21:46:43Z")
I am unable to get filebeats to create a log file and log anything. My Configuration is a little different. I have the main configuration file filebeat.yml. Than I have a different config file for each type of log im … --- ## [Creating a custom id in a mapping](https://discuss.elastic.co/t/creating-a-custom-id-in-a-mapping/65460)
**Author:** [@Denny](https://discuss.elastic.co/u/Denny)\ **Replies:** 6\ **Last updated:** [November 9, 2016, 2:57pm UTC](https://discuss.elastic.co/t/creating-a-custom-id-in-a-mapping/65460 "2016-11-09T14:57:50Z")
Hello, I'm trying to give my indexed documents a custom id. So far no luck. This is a sample from my dataset: \_DESCRIPTIONS\_ | \_VALUES\_ ID | WAUX87 Model | Avensis Each document has an ID in its… --- ## [Kibana Getting Started Error - No default index pattern](https://discuss.elastic.co/t/kibana-getting-started-error-no-default-index-pattern/25254)
**Author:** [@ScottLawrenceLawson](https://discuss.elastic.co/u/ScottLawrenceLawson)\ **Replies:** 8\ **Last updated:** [July 6, 2017, 7:48am UTC](https://discuss.elastic.co/t/kibana-getting-started-error-no-default-index-pattern/25254 "2017-07-06T07:48:12Z")
I am a newbie trying to get local Logstash and Kibana working on my Win7 laptop with Elastic Search Found in the cloud. On firing up Kibana which I configured to use my Found instance, I get the error: "Warning No defaul… --- ## [How to query private IP range in kibana?](https://discuss.elastic.co/t/how-to-query-private-ip-range-in-kibana/282532)
**Author:** [@111418](https://discuss.elastic.co/u/111418)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 6:02am UTC](https://discuss.elastic.co/t/how-to-query-private-ip-range-in-kibana/282532 "2021-08-26T06:02:08Z")
I want to query sourceIP in private IP.For example: 10.0.0.0-10.255.255.255 or 172.16.0.0 – 172.31.255.255 or 192.168.0.0 – 192.168.255.255 But I user sourceIP:\[10.0.0.0 TO 10.255.255.255\] don't work.The sourceIP field… --- ## [Log queries performed in kibana to the output log using a plugin](https://discuss.elastic.co/t/log-queries-performed-in-kibana-to-the-output-log-using-a-plugin/86979)
**Author:** [@pserrao](https://discuss.elastic.co/u/pserrao)\ **Replies:** 7\ **Last updated:** [June 19, 2017, 6:08pm UTC](https://discuss.elastic.co/t/log-queries-performed-in-kibana-to-the-output-log-using-a-plugin/86979 "2017-06-19T18:08:56Z")
I have been trying to log the query the user performs on the Kibana Discover tab into the stdout of the Kibana server. I can see from the browser see that every time the user performs a search, a POST request is made t… --- ## [Elasticsearch aggregation size](https://discuss.elastic.co/t/elasticsearch-aggregation-size/196046)
**Author:** [@lakmina\_chathurya](https://discuss.elastic.co/u/lakmina_chathurya)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-size/196046 "2019-08-21T07:20:36Z")
When i use following query, it shows only 10 buckets as default "aggs": { "group": { "terms": { "field": "user.keyword" } when i need to get all buckets i used following query "aggs": { "group": { "terms": { "f… --- ## [Ignore Text and carriage return characters](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278)
**Author:** [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\ **Replies:** 5\ **Last updated:** [May 11, 2017, 4:31pm UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278 "2017-05-11T16:31:04Z")
Hello, How can I manage log lines which have multiple /n and /r characters with Grok? The log line here is a multiline and looking to replace the /r /n with "". My filter looks like this : filter{ grok {match =\> \["mes… --- ## [How to index full xml file into ElasticSearch](https://discuss.elastic.co/t/how-to-index-full-xml-file-into-elasticsearch/39694)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 6\ **Last updated:** [January 21, 2016, 3:08pm UTC](https://discuss.elastic.co/t/how-to-index-full-xml-file-into-elasticsearch/39694 "2016-01-21T15:08:59Z")
Hi, I need to load full file into ES for our requirement and while searching i need to get the XML Nodes. Eg: My XMl FIle lets say like this ( A small example).. Doc 1) \\A1\\ **Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 8\ **Last updated:** [September 11, 2019, 9:46am UTC](https://discuss.elastic.co/t/use-index-pattern-by-name-and-not-by-id/198733 "2019-09-11T09:46:04Z") Using index-pattern ID is not clear at all. For example i have a problem - i have dasboards, that use "winlogbeat-\*" index-pattern and than i delete it (during trying fixing a problem). And that create it again. Now all… --- ## [How to backup / restore kibana index?](https://discuss.elastic.co/t/how-to-backup-restore-kibana-index/77121)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [March 3, 2017, 8:44pm UTC](https://discuss.elastic.co/t/how-to-backup-restore-kibana-index/77121 "2017-03-03T20:44:05Z")
Hi, as far as I know, kibana is storing all of its data in an own index in elasticsearch. Since plain kibana (xpack is too expensive for us) does not have any user roles, each user is equal and can modify or delete any… --- ## [Sorting on Multiple fields, JAVA API](https://discuss.elastic.co/t/sorting-on-multiple-fields-java-api/8298)
**Author:** [@Harsh](https://discuss.elastic.co/u/Harsh)\ **Replies:** 5\ **Last updated:** [September 11, 2012, 7:59am UTC](https://discuss.elastic.co/t/sorting-on-multiple-fields-java-api/8298 "2012-09-11T07:59:06Z")
Hello, I have written a small search application and have used the addSort() method for sorting the results. What I want to do is first sort the results based on its score and if the score is same then it should … --- ## ["Kibana server is not ready yet" (running with docker-compose)](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-running-with-docker-compose/279627)
**Author:** [@kkireyev](https://discuss.elastic.co/u/kkireyev)\ **Replies:** 6\ **Last updated:** [July 28, 2021, 11:43am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-running-with-docker-compose/279627 "2021-07-28T11:43:21Z")
Hi! I'm trying to follow the tutorial here: After running "docker-compose up", I can access: localhost:9200/\_cat/nodes?v&pretty but when I go to http://localhost:5601/ I get: Kibana server is not ready yet Run… --- ## [Assigning value to add\_field new field](https://discuss.elastic.co/t/assigning-value-to-add-field-new-field/56430)
**Author:** [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Replies:** 3\ **Last updated:** [July 27, 2016, 12:16am UTC](https://discuss.elastic.co/t/assigning-value-to-add-field-new-field/56430 "2016-07-27T00:16:09Z")
Hi, I get the field defined in filebeat.yml file as: - paths: - /var/logs/mylog.log document\_type: LOG1 fields: mytype: FORMAT1 ,defining different format spec for each o… --- ## [How to completely disable Xpack?](https://discuss.elastic.co/t/how-to-completely-disable-xpack/225755)
**Author:** [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)\ **Replies:** 3\ **Last updated:** [March 30, 2020, 11:47pm UTC](https://discuss.elastic.co/t/how-to-completely-disable-xpack/225755 "2020-03-30T23:47:19Z")
I have elasticsearch 7.4 running on AWS Elastic Search with Open Distro user management with curl and basic auth - I can successful call elasticsearch root: { "name": "0ea36812a52dca373179a5cbe60cfa8d", "cluster\_… --- ## [Elasticsearch on EC2. What kind of instance types to use?](https://discuss.elastic.co/t/elasticsearch-on-ec2-what-kind-of-instance-types-to-use/9918)
**Author:** [@fonzo14](https://discuss.elastic.co/u/fonzo14)\ **Replies:** 6\ **Last updated:** [December 5, 2012, 8:10pm UTC](https://discuss.elastic.co/t/elasticsearch-on-ec2-what-kind-of-instance-types-to-use/9918 "2012-12-05T20:10:05Z")
Hi, I guess many of us are deploying elasticsearch on EC2 or plan to do it. It would be great if some ES experts can give us some hints on how to choose the EC2 instance types. I know, price is the first parame… --- ## [Filebeats on windows](https://discuss.elastic.co/t/filebeats-on-windows/40490)
**Author:** [@sd\_karthik](https://discuss.elastic.co/u/sd_karthik)\ **Replies:** 3\ **Last updated:** [January 29, 2016, 9:34pm UTC](https://discuss.elastic.co/t/filebeats-on-windows/40490 "2016-01-29T21:34:51Z")
Can someone please explain me how to get Filebeats working on Windows. I have uploaded whatever I have in my windows server. Also I have configs ready on filebeat.yml. I tried to execute filebeat.exe from command line … --- ## [Data node’s cluster uuid diffrent from master node's cluster uuid](https://discuss.elastic.co/t/data-node-s-cluster-uuid-diffrent-from-master-nodes-cluster-uuid/196737)
**Author:** [@111197](https://discuss.elastic.co/u/111197)\ **Replies:** 7\ **Last updated:** [August 28, 2019, 6:53am UTC](https://discuss.elastic.co/t/data-node-s-cluster-uuid-diffrent-from-master-nodes-cluster-uuid/196737 "2019-08-28T06:53:53Z")
Hi, all. I’m trying to build elasticsearch version 7.3.0 cluster.(on docker on AWS ECS) Now, master and ingest nodes are built successfully as below. (Domain name and IPs are example name for explain.) curl EXAMPLE-D… --- ## [How can I display count instead of percentage in pie](https://discuss.elastic.co/t/how-can-i-display-count-instead-of-percentage-in-pie/150992)
**Author:** [@Denis\_Tatarenko](https://discuss.elastic.co/u/Denis_Tatarenko)\ **Replies:** 6\ **Last updated:** [October 5, 2018, 7:18am UTC](https://discuss.elastic.co/t/how-can-i-display-count-instead-of-percentage-in-pie/150992 "2018-10-05T07:18:38Z")
I have simple pie-chart visualization. I want to display labels on the chart with values, however when go to "Labels Settings" and enable "Show Values", it shows only percentage, How can I display count instead? --- ## [Microsoft Graph Security API integration](https://discuss.elastic.co/t/microsoft-graph-security-api-integration/263074)
**Author:** [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 6:35am UTC](https://discuss.elastic.co/t/microsoft-graph-security-api-integration/263074 "2021-02-03T06:35:33Z")
Filebeat has an o365 module that connects to the Microsoft Management API. Does anyone if there are working or is there a connector available for the Microsoft Graph Security API Microsoft Graph Security API overview - … --- ## [What is the meaning of "popularity" in index pattern page?](https://discuss.elastic.co/t/what-is-the-meaning-of-popularity-in-index-pattern-page/93090)
**Author:** [@Shuxin\_Lin](https://discuss.elastic.co/u/Shuxin_Lin)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 7:41am UTC](https://discuss.elastic.co/t/what-is-the-meaning-of-popularity-in-index-pattern-page/93090 "2017-07-17T07:41:23Z")
Hi, I cannot find any info online. Can someone tell me what is the meaning of "popularity" in index pattern page? --- ## [Execute a filter on nested document only if it exists](https://discuss.elastic.co/t/execute-a-filter-on-nested-document-only-if-it-exists/72720)
**Author:** [@pungent](https://discuss.elastic.co/u/pungent)\ **Replies:** 7\ **Last updated:** [January 25, 2017, 5:58pm UTC](https://discuss.elastic.co/t/execute-a-filter-on-nested-document-only-if-it-exists/72720 "2017-01-25T17:58:52Z")
I am using ES 2.3 and have a query in which filter section looks as follows: "filter": { "query": { "bool": { "must": \[ { "nested": { "path": "employees", … --- ## [Re-index API creates multiple tasks](https://discuss.elastic.co/t/re-index-api-creates-multiple-tasks/121571)
**Author:** [@ayushsangani](https://discuss.elastic.co/u/ayushsangani)\ **Replies:** 2\ **Last updated:** [March 21, 2018, 2:41pm UTC](https://discuss.elastic.co/t/re-index-api-creates-multiple-tasks/121571 "2018-03-21T14:41:47Z")
Hey all, ES version: 2.4.3 I have been using re-index API since it's launch in 2.X, it's been working fine until recently/last year. I'm noticing that whenever I execute a reindex request, it starts with one task. Afte… --- ## [Elasticsearch Output Is Failing on action =\> "update" due to missing document?](https://discuss.elastic.co/t/elasticsearch-output-is-failing-on-action-update-due-to-missing-document/67807)
**Author:** [@Evan\_Ravenelle](https://discuss.elastic.co/u/Evan_Ravenelle)\ **Replies:** 0\ **Last updated:** [December 1, 2016, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-output-is-failing-on-action-update-due-to-missing-document/67807 "2016-12-01T20:43:36Z")
I have the following input and output blocks: input { elasticsearch { index =\> "filebeat-\*" hosts =\> "localhost" query =\> '{ "query": { "dis\_max": { "queries": \[ { "match": { "tags": "\_grokparsefailure" … --- ## [Mapping for an array of keywords](https://discuss.elastic.co/t/mapping-for-an-array-of-keywords/172200)
**Author:** [@Vincent\_Stevenson](https://discuss.elastic.co/u/Vincent_Stevenson)\ **Replies:** 1\ **Last updated:** [March 13, 2019, 8:27pm UTC](https://discuss.elastic.co/t/mapping-for-an-array-of-keywords/172200 "2019-03-13T20:27:03Z")
What does the JSON mapping look like if I have a field that is of type: keyword array. If I wanted multiple keywords associated with a JSON document, how would I create the mapping for the index's field? Something like… --- ## [How to set a time range in the watcher?](https://discuss.elastic.co/t/how-to-set-a-time-range-in-the-watcher/93679)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 5\ **Last updated:** [July 24, 2017, 1:44pm UTC](https://discuss.elastic.co/t/how-to-set-a-time-range-in-the-watcher/93679 "2017-07-24T13:44:09Z")
Can I set a time range about watcher? Is there a guide for this setting? I found a sample here: https://www.elastic.co/guide/en/x-pack/5.x/watching-meetup-data.html Here is my configuration: PUT \_xpack/watche… --- ## [Max Lines Multiline Codec](https://discuss.elastic.co/t/max-lines-multiline-codec/84216)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 1\ **Last updated:** [May 2, 2017, 8:38am UTC](https://discuss.elastic.co/t/max-lines-multiline-codec/84216 "2017-05-02T08:38:39Z")
Hello EveryOne, I have a problem with one log. This log contains 600 lines and I need it to be store in ElasticSearch as a single document. So I use the multiline codec but it puts me : "Multiline codec max lines reac… --- ## [Elasticsearch 7.1.0 crash with bootstrap checks failed](https://discuss.elastic.co/t/elasticsearch-7-1-0-crash-with-bootstrap-checks-failed/190190)
**Author:** [@Karuppasamy\_K](https://discuss.elastic.co/u/Karuppasamy_K)\ **Replies:** 6\ **Last updated:** [July 16, 2019, 7:12am UTC](https://discuss.elastic.co/t/elasticsearch-7-1-0-crash-with-bootstrap-checks-failed/190190 "2019-07-16T07:12:22Z")
I tried to run elasticsearch docker image from private repository, but its getting crash with ERROR: \[1\] bootstrap checks failed. I found "bootstrap check should be enabled "Des.enforce.bootstrap.checks=true" in elasti… --- ## [Unable to find valid certification path to requested target](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 4\ **Last updated:** [November 11, 2020, 10:12pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829 "2020-11-11T22:12:47Z")
Hello, I'm trying to authenticate users via AD with no success. Running ES 7.9.2. with TLS encryption in the cluster. Below you can see the excerpt of the yml file where I'm setting up xpack security, and the error I am… --- ## [SQL IN clause equivalent](https://discuss.elastic.co/t/sql-in-clause-equivalent/149484)
**Author:** [@David\_Palmer](https://discuss.elastic.co/u/David_Palmer)\ **Replies:** 6\ **Last updated:** [September 24, 2018, 3:10pm UTC](https://discuss.elastic.co/t/sql-in-clause-equivalent/149484 "2018-09-24T15:10:59Z")
In this query: SELECT id FROM tbl WHERE id IN (1,2,3) Clearly, using the \_xpack/sql/translate endpoint this will error in that the IN clause is not supported. What would be the equivalent SQL statement for a query abo… --- ## [Kibana Metrics – 500 Internal Server Error](https://discuss.elastic.co/t/kibana-metrics-500-internal-server-error/238260)
**Author:** [@tvander](https://discuss.elastic.co/u/tvander)\ **Replies:** 2\ **Last updated:** [June 25, 2020, 1:36pm UTC](https://discuss.elastic.co/t/kibana-metrics-500-internal-server-error/238260 "2020-06-25T13:36:40Z")
When i'm trying to access to the metrics page (https://kibana-elk.pxdtools.io:5601/app/metrics) on Kibana i have an error 500 showing on the right bottom corner, and i can't use this page, i've got the "There is no data … --- ## [How to put condition based on certain string in \[message\]?](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 6\ **Last updated:** [April 10, 2018, 11:08pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169 "2018-04-10T23:08:04Z")
Hi, I am trying to apply grok only if message has certain string. For example my message has source\_type=\\"APP/PROC/WEB\\" and my config looks like, if "source\_type=\\"APP" in \[message\]{ do something } Condition is not … --- ## [How to match IP address to hostname without dns \[Solved\]](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-without-dns-solved/23919)
**Author:** [@thelastwilson](https://discuss.elastic.co/u/thelastwilson)\ **Replies:** 5\ **Last updated:** [June 22, 2015, 10:00am UTC](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-without-dns-solved/23919 "2015-06-22T10:00:25Z")
I've been attempting to deploy ELK and I'm trying to figure out how to translate IP addresses into hostnames. Currently feeding in syslog from some switches and host field comes up as IP address, not a problem but I'd qu… --- ## [Elasticsearch search query to retrieve all records NEST](https://discuss.elastic.co/t/elasticsearch-search-query-to-retrieve-all-records-nest/52562)
**Author:** [@ASN](https://discuss.elastic.co/u/ASN)\ **Replies:** 6\ **Last updated:** [June 14, 2016, 1:48am UTC](https://discuss.elastic.co/t/elasticsearch-search-query-to-retrieve-all-records-nest/52562 "2016-06-14T01:48:59Z")
I have few documents in a folder and I want to check if all the documents in this folder are indexed or not. To do so, for each document name in the folder, I would like to run through a loop for the documents indexed in… [Previous page](https://discuss.elastic.co/top.md?page=280&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=282&per_page=50&period=all)