# Top **URL:** https://discuss.elastic.co/top.md?page=305&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 306 --- ## [How to set loglevel to debug in Elasticsearch 5.1?](https://discuss.elastic.co/t/how-to-set-loglevel-to-debug-in-elasticsearch-5-1/72653)
**Author:** [@robertchen117](https://discuss.elastic.co/u/robertchen117)\ **Replies:** 4\ **Last updated:** [January 25, 2017, 4:22pm UTC](https://discuss.elastic.co/t/how-to-set-loglevel-to-debug-in-elasticsearch-5-1/72653 "2017-01-25T16:22:18Z")
how to set loglevel to debug in Elasticsearch 5.1 cluster? It is very strange I googled and could not find anything for this simple question. --- ## [What's the difference between the marvel basic vs subscription licenses?](https://discuss.elastic.co/t/whats-the-difference-between-the-marvel-basic-vs-subscription-licenses/33421)
**Author:** [@bennett](https://discuss.elastic.co/u/bennett)\ **Replies:** 3\ **Last updated:** [April 20, 2016, 6:02pm UTC](https://discuss.elastic.co/t/whats-the-difference-between-the-marvel-basic-vs-subscription-licenses/33421 "2016-04-20T18:02:49Z")
Hi, I was just wondering what features are disabled on the basic license version of the marvel app/plugin. I can't find any documentation saying what you get with basic vs what you get with a subscription. --- ## [How much memory does single elastic search instance need for 200MB of document?](https://discuss.elastic.co/t/how-much-memory-does-single-elastic-search-instance-need-for-200mb-of-document/238217)
**Author:** [@shahidcodes](https://discuss.elastic.co/u/shahidcodes)\ **Replies:** 5\ **Last updated:** [June 25, 2020, 6:01am UTC](https://discuss.elastic.co/t/how-much-memory-does-single-elastic-search-instance-need-for-200mb-of-document/238217 "2020-06-25T06:01:10Z")
Hi, I am running a single elastic search instance, the ram consumption is always above 90% of total 4GB ram. Does elasticsearch needs alot of ram by default? --- ## [How can I search in all fields?](https://discuss.elastic.co/t/how-can-i-search-in-all-fields/296249)
**Author:** [@sramana235](https://discuss.elastic.co/u/sramana235)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 10:53am UTC](https://discuss.elastic.co/t/how-can-i-search-in-all-fields/296249 "2022-02-09T10:53:11Z")
Hello, I've been asking a lot of questions lately. Is it impossible to search in all fields from the Elasticsearch 7.0.0 version now? Can't I use \_all anymore? If I can't use it, is there any other way? Or I wonder i… --- ## [Count number of array element for each document](https://discuss.elastic.co/t/count-number-of-array-element-for-each-document/17593)
**Author:** [@Niv\_Penso](https://discuss.elastic.co/u/Niv_Penso)\ **Replies:** 2\ **Last updated:** [August 6, 2014, 8:43am UTC](https://discuss.elastic.co/t/count-number-of-array-element-for-each-document/17593 "2014-08-06T08:43:21Z")
Hey Guys, I am trying to count the element's number of specific field (array) for each document. I have looked it here: and it seems that I have to use value\_count aggregation and script to count the number of the … --- ## [How to backup/Archive closed ES indexes](https://discuss.elastic.co/t/how-to-backup-archive-closed-es-indexes/26074)
**Author:** [@dmccuk](https://discuss.elastic.co/u/dmccuk)\ **Replies:** 4\ **Last updated:** [July 28, 2015, 2:04pm UTC](https://discuss.elastic.co/t/how-to-backup-archive-closed-es-indexes/26074 "2015-07-28T14:04:53Z")
Hi All, I've checked on here for anything similar but didn't find anything. Hopefully you have some suggestions. And before I start I'm a Linux admin so that's how I'm thinking in my post \[smile\]. My setup: \* Stand… --- ## [Testing connection with Elasticsearch failed due to exception java.util.concurrent.CompletionException: java.net.ConnectException: Connection refused: no further information](https://discuss.elastic.co/t/testing-connection-with-elasticsearch-failed-due-to-exception-java-util-concurrent-completionexception-java-net-connectexception-connection-refused-no-further-information/83513)
**Author:** [@DirkTeulings](https://discuss.elastic.co/u/DirkTeulings)\ **Replies:** 3\ **Last updated:** [April 25, 2017, 9:48am UTC](https://discuss.elastic.co/t/testing-connection-with-elasticsearch-failed-due-to-exception-java-util-concurrent-completionexception-java-net-connectexception-connection-refused-no-further-information/83513 "2017-04-25T09:48:43Z")
c.a.b.s.s.i.t.DefaultElasticsearchConnectionTester Testing connection with Elasticsearch failed due to exception java.util.concurrent.CompletionException: java.net.ConnectException: Connection refused: no further informa… --- ## [Insensitive case sort error : "Mapping definition for \[fields\] has unsupported parameters: \[analyzer : case\_insensitive\_sort\]"](https://discuss.elastic.co/t/insensitive-case-sort-error-mapping-definition-for-fields-has-unsupported-parameters-analyzer-case-insensitive-sort/71877)
**Author:** [@ptrussart](https://discuss.elastic.co/u/ptrussart)\ **Replies:** 3\ **Last updated:** [February 1, 2017, 5:30pm UTC](https://discuss.elastic.co/t/insensitive-case-sort-error-mapping-definition-for-fields-has-unsupported-parameters-analyzer-case-insensitive-sort/71877 "2017-02-01T17:30:42Z")
Hello, I'm trying to configure an insensitive case sort in my ES 5.1.1 . I have followed the ES documentation and I have create my mapping this way : PUT g\_config POST g\_config/\_close PUT g\_config/\_settings { "… --- ## [Alert when okay](https://discuss.elastic.co/t/alert-when-okay/112707)
**Author:** [@acchaulk](https://discuss.elastic.co/u/acchaulk)\ **Replies:** 4\ **Last updated:** [January 2, 2018, 3:08pm UTC](https://discuss.elastic.co/t/alert-when-okay/112707 "2018-01-02T15:08:40Z")
Does watcher have a mechanism to alert when an alarm is resolved? I want an alert to signify when an alert transitioned from error to okay. --- ## [Query multi value field, to match all values passed in](https://discuss.elastic.co/t/query-multi-value-field-to-match-all-values-passed-in/54483)
**Author:** [@lahiru.m](https://discuss.elastic.co/u/lahiru.m)\ **Replies:** 1\ **Last updated:** [July 4, 2016, 8:12am UTC](https://discuss.elastic.co/t/query-multi-value-field-to-match-all-values-passed-in/54483 "2016-07-04T08:12:44Z")
Hi All, I have data in elasticsearch with the mapping for an index type entity that looks like the following. The value for the field "codes" would be a list of comma separated strings "mappings": { "entity": { … --- ## [Rotate and remove old Logstash output logs](https://discuss.elastic.co/t/rotate-and-remove-old-logstash-output-logs/256803)
**Author:** [@denisdM](https://discuss.elastic.co/u/denisdM)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 5:09pm UTC](https://discuss.elastic.co/t/rotate-and-remove-old-logstash-output-logs/256803 "2020-12-09T17:09:20Z")
Hello, I've got a Logstash installation (centos 7.6, Logstash 7.2.0) which work great but produce logs and never delete them. I've never changed any default configuration so the /etc/logstash/log4j2.properties files co… --- ## [Change ES cluster\_uuid](https://discuss.elastic.co/t/change-es-cluster-uuid/193092)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 7\ **Last updated:** [August 1, 2019, 10:57am UTC](https://discuss.elastic.co/t/change-es-cluster-uuid/193092 "2019-08-01T10:57:44Z")
hi, I saw that I have two different cluster with the same cluster\_uuid. I don't know how this could happened but I can say that I cloned one node from the first cluster to create the new one. is there a way to change t… --- ## [Can you set ES node name to same as the machine hostname?](https://discuss.elastic.co/t/can-you-set-es-node-name-to-same-as-the-machine-hostname/900)
**Author:** [@MattStibbs](https://discuss.elastic.co/u/MattStibbs)\ **Replies:** 5\ **Last updated:** [May 20, 2015, 9:19am UTC](https://discuss.elastic.co/t/can-you-set-es-node-name-to-same-as-the-machine-hostname/900 "2015-05-20T09:19:06Z")
Is it possible to use environment variables or similar to automatically set an Elasticsearch node name to the hostname of the machine? i.e. if a machine is called ES1, the ES node name would also be ES1 without having … --- ## [Index settings creation date](https://discuss.elastic.co/t/index-settings-creation-date/109380)
**Author:** [@EloaCardoso](https://discuss.elastic.co/u/EloaCardoso)\ **Replies:** 4\ **Last updated:** [December 5, 2017, 8:28am UTC](https://discuss.elastic.co/t/index-settings-creation-date/109380 "2017-12-05T08:28:53Z")
I would like to know if there is a way to use query to get the creation\_date value of an index? I really need to use query and not just: GET /\_all/\_settings/index.creation\_date --- ## [Editing a managed policy can break Kibana](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/308836)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 9:12pm UTC](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/308836 "2022-07-04T21:12:41Z")
Just upgraded a Cloud deployment to 8.3.1 ... I'm still working on tuning usage, to try to figure out how to ensure that we're using resources efficiently. I've been looking at storage usage, and using lifecycle polici… --- ## [SocketTimeoutException while using JEST to connect to ES](https://discuss.elastic.co/t/sockettimeoutexception-while-using-jest-to-connect-to-es/18320)
**Author:** [@anuj\_maheshwari](https://discuss.elastic.co/u/anuj_maheshwari)\ **Replies:** 7\ **Last updated:** [June 6, 2017, 6:59am UTC](https://discuss.elastic.co/t/sockettimeoutexception-while-using-jest-to-connect-to-es/18320 "2017-06-06T06:59:57Z")
Hi, I am evaluating Log Stash and Elastic Search for one of our requirement. I have to query data from Elastic Search in a Java Application. I am trying to use JEST to make a HTTP/REST call to ES. When I am trying… --- ## [403 Exception when trying to write to ElasticSearch using ElasticsearchSink](https://discuss.elastic.co/t/403-exception-when-trying-to-write-to-elasticsearch-using-elasticsearchsink/61317)
**Author:** [@thinkabout](https://discuss.elastic.co/u/thinkabout)\ **Replies:** 2\ **Last updated:** [September 23, 2016, 5:56am UTC](https://discuss.elastic.co/t/403-exception-when-trying-to-write-to-elasticsearch-using-elasticsearchsink/61317 "2016-09-23T05:56:12Z")
Hi, I am using elasticsearch-5.0.0-alpha5 and trying to write to ElasticSearch using the latest Serilog.Sinks.Elasticsearch.ElasticsearchSink, however, I'm getting a 403 exception (see below). My setup code is … --- ## [Elasticsearch fails to install with Header V4 RSA/SHA1 signature: BAD, key ID d88e42b4](https://discuss.elastic.co/t/elasticsearch-fails-to-install-with-header-v4-rsa-sha1-signature-bad-key-id-d88e42b4/46146)
**Author:** [@ikovalev](https://discuss.elastic.co/u/ikovalev)\ **Replies:** 7\ **Last updated:** [December 21, 2016, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-install-with-header-v4-rsa-sha1-signature-bad-key-id-d88e42b4/46146 "2016-12-21T16:51:31Z")
I am in restricted environment and cannot do rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch . Therefore I downloaded elasticsearch-2.3.0.rpm from website to install on RedHat 2.6.18-407.el5 #1 SMP Fri O… --- ## [Kibana heap size](https://discuss.elastic.co/t/kibana-heap-size/219988)
**Author:** [@Aleksandra\_Minko](https://discuss.elastic.co/u/Aleksandra_Minko)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 3:01pm UTC](https://discuss.elastic.co/t/kibana-heap-size/219988 "2020-02-21T15:01:18Z")
Hi, How can i increase the heap size memory for Kibana. I'm using the version 7.6. I tried : export NODE\_OPTIONS=--max-old-space-size=8000. It didn't work. Anyone could help me on this. Thanks ! Aleksandra --- ## [Output from logstash A into input of logstash B over tcp](https://discuss.elastic.co/t/output-from-logstash-a-into-input-of-logstash-b-over-tcp/29161)
**Author:** [@trekr5](https://discuss.elastic.co/u/trekr5)\ **Replies:** 3\ **Last updated:** [September 16, 2015, 2:06pm UTC](https://discuss.elastic.co/t/output-from-logstash-a-into-input-of-logstash-b-over-tcp/29161 "2015-09-16T14:06:04Z")
Hello, I'm hoping someone can help me. I'm trying to output data over tcp from one logstash (logstash A) into the input of another (logstash B). These are my config files from logstash A:- output { tcp { … --- ## [Hardware requirements for client and master-only nodes](https://discuss.elastic.co/t/hardware-requirements-for-client-and-master-only-nodes/20811)
**Author:** [@lasseschou](https://discuss.elastic.co/u/lasseschou)\ **Replies:** 4\ **Last updated:** [September 15, 2016, 5:05am UTC](https://discuss.elastic.co/t/hardware-requirements-for-client-and-master-only-nodes/20811 "2016-09-15T05:05:20Z")
Hi, There is an excellent question asked about two years ago that was never properly answered: https://groups.google.com/forum/#!topic/elasticsearch/dxjpMd4vNXQ I have the exact same question. I've got a cluste… --- ## [Elasticsearch doesn't start after editting conf file](https://discuss.elastic.co/t/elasticsearch-doesnt-start-after-editting-conf-file/68406)
**Author:** [@tanimoto](https://discuss.elastic.co/u/tanimoto)\ **Replies:** 2\ **Last updated:** [December 8, 2016, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-start-after-editting-conf-file/68406 "2016-12-08T09:03:50Z")
I added new lines in /etc/elasticsearch/elasticsearch.yml and restart elasticsearch. added lines : (tried to set kuromoji plugin as default analyzer) index.analysis.analyzer.default.type: custom index.analysis.anal… --- ## [Elasticsearch on raspberry pi 4 with raspbian](https://discuss.elastic.co/t/elasticsearch-on-raspberry-pi-4-with-raspbian/200535)
**Author:** [@martingwb\_99](https://discuss.elastic.co/u/martingwb_99)\ **Replies:** 8\ **Last updated:** [October 27, 2019, 7:36pm UTC](https://discuss.elastic.co/t/elasticsearch-on-raspberry-pi-4-with-raspbian/200535 "2019-10-27T19:36:36Z")
Anyone with a good description how ES can be run on a raspberry pi 4 with raspbian? I have tried to use the information from this thread but was not successful. When checking syslog I can see two lines saying elasticse… --- ## [Encountered a retryable error. Will Retry with exponential backoff code=\>413](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413/234331)
**Author:** [@avneshkumar98](https://discuss.elastic.co/u/avneshkumar98)\ **Replies:** 3\ **Last updated:** [May 27, 2020, 12:41pm UTC](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413/234331 "2020-05-27T12:41:25Z")
please help, How to solve this error, \[2020-05-26T17:59:29,435\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[6286b14da4febadbf6b521991fe9dc9d011c6f3bdb1ee16e9be4527536d2d765\] Encountered a retryable error. Will Retry wi… --- ## [Problem with filebeat yml file on Windows](https://discuss.elastic.co/t/problem-with-filebeat-yml-file-on-windows/167154)
**Author:** [@dhiraj\_khanna](https://discuss.elastic.co/u/dhiraj_khanna)\ **Replies:** 6\ **Last updated:** [February 6, 2019, 1:17am UTC](https://discuss.elastic.co/t/problem-with-filebeat-yml-file-on-windows/167154 "2019-02-06T01:17:05Z")
I am quite new to the Elastic stack and trying to experiment with visualization of apache log files in Kibana. I am using filebeat to ingest the apache logs. However when I run .\\filebeat.exe setup -e, I get the followin… --- ## [Logstash SSL verification](https://discuss.elastic.co/t/logstash-ssl-verification/322615)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 11:15am UTC](https://discuss.elastic.co/t/logstash-ssl-verification/322615 "2023-01-09T11:15:05Z")
Hello, how can I enable SSL certificate verification in my logstash pipeline output to elasticsearch? I don't find any documentation on which certificates to use here. The cluster version is 8.5.3. This is my logstash… --- ## [How to use jdbc to import data into nested objects?](https://discuss.elastic.co/t/how-to-use-jdbc-to-import-data-into-nested-objects/52871)
**Author:** [@DaanCreemers](https://discuss.elastic.co/u/DaanCreemers)\ **Replies:** 7\ **Last updated:** [July 29, 2020, 10:59am UTC](https://discuss.elastic.co/t/how-to-use-jdbc-to-import-data-into-nested-objects/52871 "2020-07-29T10:59:17Z")
Hi everybody, I have multiple tables in my database which I would like to import into Elasticsearch using a single document type. One of the tables has a one-to-many relation to another table. I will use the example… --- ## [How to setup multiple config file in logstash](https://discuss.elastic.co/t/how-to-setup-multiple-config-file-in-logstash/223059)
**Author:** [@malleshrp](https://discuss.elastic.co/u/malleshrp)\ **Replies:** 2\ **Last updated:** [March 11, 2020, 11:09am UTC](https://discuss.elastic.co/t/how-to-setup-multiple-config-file-in-logstash/223059 "2020-03-11T11:09:13Z")
I want to setup multiple config files in logstash.. currently running individual .conf files which will transfer data from mysql to elasticsearch. I am having 90 files how do I setup in one config file for production … --- ## [Upsert Examples](https://discuss.elastic.co/t/upsert-examples/10115)
**Author:** [@avin](https://discuss.elastic.co/u/avin)\ **Replies:** 2\ **Last updated:** [December 19, 2012, 8:02am UTC](https://discuss.elastic.co/t/upsert-examples/10115 "2012-12-19T08:02:47Z")
Newbie here. I am trying to create an index using upsert curl -XPOST 'localhost:9200/metadata/load/ind1/\_update' -d '{ "script" : "ctx.op = "none"", "upsert" : { doc: {"Key1" : "Value1"} } }' Output: {"ok":tru… --- ## [Write to multiple indices via one alias](https://discuss.elastic.co/t/write-to-multiple-indices-via-one-alias/7620)
**Author:** [@Nicolas\_Lalevee](https://discuss.elastic.co/u/Nicolas_Lalevee)\ **Replies:** 8\ **Last updated:** [September 11, 2012, 9:49pm UTC](https://discuss.elastic.co/t/write-to-multiple-indices-via-one-alias/7620 "2012-09-11T21:49:46Z")
It would be useful when I want to do a major change in the mapping. Say I have one index, being used for read and write. Now I create a new index with a new mapping. I want then to have queries still querying the first i… --- ## [Install specific plugin version](https://discuss.elastic.co/t/install-specific-plugin-version/1407)
**Author:** [@rectalogic](https://discuss.elastic.co/u/rectalogic)\ **Replies:** 1\ **Last updated:** [May 28, 2015, 1:16am UTC](https://discuss.elastic.co/t/install-specific-plugin-version/1407 "2015-05-28T01:16:30Z")
How do I install a specific version of a plugin? plugin install --version fails because the plugin is locked at an older version. Uninstalling and then installing also fails. I'm using logstash 1.5.0 from the deb repos… --- ## [Kibana Error Connecting to ES on Docker - Cannot Revive Connection](https://discuss.elastic.co/t/kibana-error-connecting-to-es-on-docker-cannot-revive-connection/133335)
**Author:** [@chrisruel](https://discuss.elastic.co/u/chrisruel)\ **Replies:** 2\ **Last updated:** [May 25, 2018, 6:39pm UTC](https://discuss.elastic.co/t/kibana-error-connecting-to-es-on-docker-cannot-revive-connection/133335 "2018-05-25T18:39:48Z")
I am getting an error attempting to connect Kibana to ES using Docker containers: kibana-products-624 | {"type":"log","@timestamp":"2018-05-25T14:56:36Z","tags":\["warning","elasticsearch","admin"\],"pid… --- ## [Sending Java Logs to Elastic Search, an efficient way?](https://discuss.elastic.co/t/sending-java-logs-to-elastic-search-an-efficient-way/27475)
**Author:** [@Zeal\_Vora](https://discuss.elastic.co/u/Zeal_Vora)\ **Replies:** 4\ **Last updated:** [August 20, 2015, 10:16pm UTC](https://discuss.elastic.co/t/sending-java-logs-to-elastic-search-an-efficient-way/27475 "2015-08-20T22:16:44Z")
Hi We are planning to have centralized logging system and have been sending Linux related logs to Elastic Search and searching them via Kibana. We were planning to send Java LOGS as well. So was wondering, is it effi… --- ## [Logstash Too many open files](https://discuss.elastic.co/t/logstash-too-many-open-files/35589)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 7\ **Last updated:** [July 5, 2016, 7:10pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589 "2016-07-05T19:10:46Z")
Hi, running logstash 2.0.0-1 on Ubuntu 12.04.3 LTS , logstash running for about 24 hours then dying with 'Too many open files' paste -\> http://pastebin.com/YsyKPUTL ES is running on this same host, with two hosts s… --- ## [Filtering Winlogbeat on Event ID](https://discuss.elastic.co/t/filtering-winlogbeat-on-event-id/43899)
**Author:** [@Sean\_Lamm](https://discuss.elastic.co/u/Sean_Lamm)\ **Replies:** 7\ **Last updated:** [March 14, 2016, 8:49pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-on-event-id/43899 "2016-03-14T20:49:54Z")
Is there a way to filter events in winlogbeat so I am only sending certain event id's? I am specifically looking to send only event id 8003 for now to limit the transmission of data to our ELK stack. I have around 20,000… --- ## [How do perform string manipulations](https://discuss.elastic.co/t/how-do-perform-string-manipulations/32706)
**Author:** [@samnik60](https://discuss.elastic.co/u/samnik60)\ **Replies:** 7\ **Last updated:** [October 22, 2015, 8:04am UTC](https://discuss.elastic.co/t/how-do-perform-string-manipulations/32706 "2015-10-22T08:04:55Z")
the string manipulations has been hard from me with logstash, how do i do substr(destinationid,instr(destinationid,"discard"),7) --- ## [Configure retention period for different index](https://discuss.elastic.co/t/configure-retention-period-for-different-index/106491)
**Author:** [@YaroslavN](https://discuss.elastic.co/u/YaroslavN)\ **Replies:** 4\ **Last updated:** [November 9, 2017, 7:25am UTC](https://discuss.elastic.co/t/configure-retention-period-for-different-index/106491 "2017-11-09T07:25:58Z")
Hi, Could we set up different retention policies for indices in ElasticClooud? For example: index\_A should auto-deleted after 7 days, index\_B should be deleted after 10 days, etc. Thank you. --- ## [Output to indices based on field in message](https://discuss.elastic.co/t/output-to-indices-based-on-field-in-message/83719)
**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 5:34am UTC](https://discuss.elastic.co/t/output-to-indices-based-on-field-in-message/83719 "2017-04-27T05:34:54Z")
I have some logs have same filenames like access\_20170427.log, then content in it is like \[{user\_id:123, act:play, timestamp:2017-04-23 08:00:00},{user\_id:456, act:play, timestamp:2017-04-23 08:00:00}\] I want to put them… --- ## [Is it possible to Snapshot ALL indices and exclude some?](https://discuss.elastic.co/t/is-it-possible-to-snapshot-all-indices-and-exclude-some/237047)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 0\ **Last updated:** [June 15, 2020, 1:58am UTC](https://discuss.elastic.co/t/is-it-possible-to-snapshot-all-indices-and-exclude-some/237047 "2020-06-15T01:58:42Z")
Hey there, The use case is: I want to default snapshot all indices. But, I want to leave out a few of them. The environment I am working on is dynamic, and new indices are created daily. I want to determine with each … --- ## [Permission denied error in plugin for ES 2.2.0](https://discuss.elastic.co/t/permission-denied-error-in-plugin-for-es-2-2-0/40915)
**Author:** [@mkelkar](https://discuss.elastic.co/u/mkelkar)\ **Replies:** 5\ **Last updated:** [February 8, 2016, 2:56pm UTC](https://discuss.elastic.co/t/permission-denied-error-in-plugin-for-es-2-2-0/40915 "2016-02-08T14:56:15Z")
Hi All, I am trying to write a plugin for ES 2.2.0. When I start elasticsearch with plugin installed, this is what I get - Likely root cause: java.security.AccessControlException: access denied ("javax.management… --- ## [Logstash not able to access the custom field from Filebeat](https://discuss.elastic.co/t/logstash-not-able-to-access-the-custom-field-from-filebeat/87553)
**Author:** [@Dattatray\_Kulkarni](https://discuss.elastic.co/u/Dattatray_Kulkarni)\ **Replies:** 1\ **Last updated:** [May 30, 2017, 3:25pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-access-the-custom-field-from-filebeat/87553 "2017-05-30T15:25:50Z")
Hi, I have multiple types of log files from different servers. So I am using multiple filebeat agents. In the Filebeat configuration, I am adding a custom field - log\_type Here is the snippet of the filebeat configur… --- ## [Failed to start filebeat (more than one namespace)](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016)
**Author:** [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Replies:** 6\ **Last updated:** [April 30, 2018, 5:07pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016 "2018-04-30T17:07:56Z")
when i start filebeat and see status of service i have as output ; more than one namespace configured accessing 'output' /etc/filebeat/filebeat.yml how can i resolve this problem ,(i am trying to send bro logs to elasti… --- ## [Set Home Page as Dashboard](https://discuss.elastic.co/t/set-home-page-as-dashboard/231244)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 6\ **Last updated:** [May 6, 2020, 12:07pm UTC](https://discuss.elastic.co/t/set-home-page-as-dashboard/231244 "2020-05-06T12:07:58Z")
Hi, I know earlier (in 4.4 version), we didn't have the option to set a dashboard as a home page in Kibana. Is it still unavailable? Thanks in advance. Thanks, Brit --- ## [Iterate over hits to get value of fields for my hits in my Mail box body from Watcher](https://discuss.elastic.co/t/iterate-over-hits-to-get-value-of-fields-for-my-hits-in-my-mail-box-body-from-watcher/48549)
**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Replies:** 3\ **Last updated:** [October 23, 2016, 8:03am UTC](https://discuss.elastic.co/t/iterate-over-hits-to-get-value-of-fields-for-my-hits-in-my-mail-box-body-from-watcher/48549 "2016-10-23T08:03:14Z")
Hi, Let i got 4 hits when i run my filter query in my input section of watcher. And Under action ,i want to send the value of all hits field in the body of my mail box.So How i iterate for loop over my hits in actio… --- ## [Removing .marvel indices from elasticsearch](https://discuss.elastic.co/t/removing-marvel-indices-from-elasticsearch/28488)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 7\ **Last updated:** [September 3, 2015, 7:51am UTC](https://discuss.elastic.co/t/removing-marvel-indices-from-elasticsearch/28488 "2015-09-03T07:51:51Z")
Hi, I have removed marvel plugin from all of my ES Nodes using bin/plugin --remove marvel. Doing bin/plugin --list is also not showing the marvel plugin. But I am still seeing indices of type .marvel-2015.09.02 indice… --- ## [GeoIP LookUp failure](https://discuss.elastic.co/t/geoip-lookup-failure/134936)
**Author:** [@asajj](https://discuss.elastic.co/u/asajj)\ **Replies:** 5\ **Last updated:** [June 8, 2018, 3:03pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936 "2018-06-08T15:03:59Z")
Hi Everyone, i'm playing a bit with the ELK-Stack and i have a problem with the GeoIP-Filte of Logstash. Via Winlogbeat I send EventLogs (more exact Network Sysmon Events). If a connection is established in generates a… --- ## [Get the most recent record which matches a field](https://discuss.elastic.co/t/get-the-most-recent-record-which-matches-a-field/221635)
**Author:** [@mbozic00](https://discuss.elastic.co/u/mbozic00)\ **Replies:** 5\ **Last updated:** [March 2, 2020, 10:04am UTC](https://discuss.elastic.co/t/get-the-most-recent-record-which-matches-a-field/221635 "2020-03-02T10:04:41Z")
Hi, When I perform this query: { "query": { "match": { "service\_id": "foo" } }, "size": 1 } I get one entry (the earliest by timestamp) that matches the desired service\_id. However, I would like to retrieve … --- ## [Metricbeat failed to start on linux](https://discuss.elastic.co/t/metricbeat-failed-to-start-on-linux/127410)
**Author:** [@Timotius\_Pamungkas](https://discuss.elastic.co/u/Timotius_Pamungkas)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 5:35am UTC](https://discuss.elastic.co/t/metricbeat-failed-to-start-on-linux/127410 "2018-04-10T05:35:31Z")
I can's start metricbeat service on linux. I'm following the guides on https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-starting.html But when starting metricbeat, it shows following error: $ sudo se… --- ## [Map User Location with GeoIP and ELK](https://discuss.elastic.co/t/map-user-location-with-geoip-and-elk/78129)
**Author:** [@RustuGurkan](https://discuss.elastic.co/u/RustuGurkan)\ **Replies:** 3\ **Last updated:** [March 10, 2017, 1:50pm UTC](https://discuss.elastic.co/t/map-user-location-with-geoip-and-elk/78129 "2017-03-10T13:50:35Z")
Hi I'm having troubles with mapping user locations with GeoIP. Could someone help me please I followed the tutorial on: my config on /etc/logstash/12-apache.conf looks like this: geoip { source =\> "clientip… --- ## [Multiline and grok filter to merge multi line and then filter](https://discuss.elastic.co/t/multiline-and-grok-filter-to-merge-multi-line-and-then-filter/91219)
**Author:** [@mharoonahmed](https://discuss.elastic.co/u/mharoonahmed)\ **Replies:** 6\ **Last updated:** [July 4, 2017, 5:40am UTC](https://discuss.elastic.co/t/multiline-and-grok-filter-to-merge-multi-line-and-then-filter/91219 "2017-07-04T05:40:18Z")
Hi experts I am very new to ELK stack and still learning. I have some logs streamed from a switch reporting congestion. Below is the log format. Record shows start, update and stop type records, with timestamp, interf… [Previous page](https://discuss.elastic.co/top.md?page=304&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=306&per_page=50&period=all)