# Top **URL:** https://discuss.elastic.co/top.md?page=320&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 321 --- ## [Filebeat assumes UTC?](https://discuss.elastic.co/t/filebeat-assumes-utc/80896)
**Author:** [@beatsme](https://discuss.elastic.co/u/beatsme)\ **Replies:** 7\ **Last updated:** [April 3, 2017, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-assumes-utc/80896 "2017-04-03T12:56:59Z")
I'm using filebeat to import syslog messages. When looking at the ES document it appears filebeat incorrectly assumes UTC: ES document: "@timestamp": "2017-04-01T15:26:51.000Z" Syslog message "timestamp": "Apr 1 … --- ## [\[illegal\_state\_exception\] value source config is invalid; must have either a field context or a script or marked as unwrapped](https://discuss.elastic.co/t/illegal-state-exception-value-source-config-is-invalid-must-have-either-a-field-context-or-a-script-or-marked-as-unwrapped/93222)
**Author:** [@jimavlad](https://discuss.elastic.co/u/jimavlad)\ **Replies:** 4\ **Last updated:** [July 15, 2017, 5:33pm UTC](https://discuss.elastic.co/t/illegal-state-exception-value-source-config-is-invalid-must-have-either-a-field-context-or-a-script-or-marked-as-unwrapped/93222 "2017-07-15T17:33:21Z")
Hi, I am trying to set-up Machine Learning in Kibana using the X-pack plugin. I uploaded some test data in the following format: "anomaly": { "properties": { "device": { "properties": { … --- ## [Some of our public repositories are not available ATM](https://discuss.elastic.co/t/some-of-our-public-repositories-are-not-available-atm/369726)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 1\ **Last updated:** [October 29, 2024, 5:49pm UTC](https://discuss.elastic.co/t/some-of-our-public-repositories-are-not-available-atm/369726 "2024-10-29T17:49:43Z")
As part of an internal change task, some of our public git repositories hosted under Elastic's GitHub organisation were marked as private. As a result, when attempting to access these repositories an error may be seen. O… --- ## [ES 5.2.0 in KVM - Netty Warning : Failed to find a usable hardware address from the network interfaces](https://discuss.elastic.co/t/es-5-2-0-in-kvm-netty-warning-failed-to-find-a-usable-hardware-address-from-the-network-interfaces/73717)
**Author:** [@fciocchetti](https://discuss.elastic.co/u/fciocchetti)\ **Replies:** 4\ **Last updated:** [February 3, 2017, 2:19am UTC](https://discuss.elastic.co/t/es-5-2-0-in-kvm-netty-warning-failed-to-find-a-usable-hardware-address-from-the-network-interfaces/73717 "2017-02-03T02:19:23Z")
I just upgraded my test cluster from 5.1.2 to 5.2 and i can see a "new warning" in my logs, i think is from Netty (which was upgraded from 4.1.6 to 4.1.7 according to docs) \[2017-02-02T14:46:48,481\]\[WARN \]\[i.n.u.i.Ma… --- ## [How to access Kibana with x-pack security disabled?](https://discuss.elastic.co/t/how-to-access-kibana-with-x-pack-security-disabled/308347)
**Author:** [@dendog](https://discuss.elastic.co/u/dendog)\ **Replies:** 6\ **Last updated:** [June 30, 2022, 10:32am UTC](https://discuss.elastic.co/t/how-to-access-kibana-with-x-pack-security-disabled/308347 "2022-06-30T10:32:02Z")
Hi! I starting es and kibana in a docker compose file, I have set xpack.security.enabled=false, but when accessing the kibana UI I am still asked for an enrollment token, which from my understanding would not be generat… --- ## [Directly Connecting MySQL DB to Kibana for visualization](https://discuss.elastic.co/t/directly-connecting-mysql-db-to-kibana-for-visualization/239982)
**Author:** [@Karan\_Gupta10](https://discuss.elastic.co/u/Karan_Gupta10)\ **Replies:** 4\ **Last updated:** [July 6, 2020, 2:34pm UTC](https://discuss.elastic.co/t/directly-connecting-mysql-db-to-kibana-for-visualization/239982 "2020-07-06T14:34:30Z")
Hi My current problem statement involves connecting to MySQL DB to fetch the data and produce Datavisualization in Kibana. Is there a way to directly connect with MySQL DB from Kibana. If not, then what are the other … --- ## [Terms lookup mechanism with multiple lookup docs](https://discuss.elastic.co/t/terms-lookup-mechanism-with-multiple-lookup-docs/17676)
**Author:** [@Valery\_Ayala](https://discuss.elastic.co/u/Valery_Ayala)\ **Replies:** 0\ **Last updated:** [May 22, 2014, 1:45pm UTC](https://discuss.elastic.co/t/terms-lookup-mechanism-with-multiple-lookup-docs/17676 "2014-05-22T13:45:37Z")
Is it possible to use this feature with a lookup on multiple documents (multiple IDs) to supply the terms? http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-terms-filter.html#\_terms\_looku… --- ## [How to choose/change the maximum size of a segment?](https://discuss.elastic.co/t/how-to-choose-change-the-maximum-size-of-a-segment/70631)
**Author:** [@chenjinyuan87](https://discuss.elastic.co/u/chenjinyuan87)\ **Replies:** 6\ **Last updated:** [January 5, 2017, 10:02am UTC](https://discuss.elastic.co/t/how-to-choose-change-the-maximum-size-of-a-segment/70631 "2017-01-05T10:02:38Z")
Hello all: I found the maximum size of segments in es5.0/lucene6 is 5GB. Since my index size is more than 500GB, i have 100 segments now. I think this should slow down my search speed. But i'm not sure if i should cha… --- ## [Nested multiple Geo Point locations - sorting with geo distance point not returning all distances](https://discuss.elastic.co/t/nested-multiple-geo-point-locations-sorting-with-geo-distance-point-not-returning-all-distances/181646)
**Author:** [@krishnapss](https://discuss.elastic.co/u/krishnapss)\ **Replies:** 3\ **Last updated:** [May 22, 2019, 11:14am UTC](https://discuss.elastic.co/t/nested-multiple-geo-point-locations-sorting-with-geo-distance-point-not-returning-all-distances/181646 "2019-05-22T11:14:05Z")
I have created an index which has nested locations of Geo point type. When sorting the results are only returning one distance. How to get distance of all locations with in a single document. Please help me with this i… --- ## [Elastic Cloud Enterprise 1.0.2 Now Available](https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-now-available/100243)
**Author:** [@uricohen](https://discuss.elastic.co/u/uricohen)\ **Replies:** 0\ **Last updated:** [September 12, 2017, 4:29pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-now-available/100243 "2017-09-12T16:29:01Z")
We are happy to announce the release of ECE 1.0.2! This new version includes: Support for live upgrading - Our main improvement in this version. We now support live upgrading to new ECE versions without downtime for man… --- ## [Date math for index names - date range possible?](https://discuss.elastic.co/t/date-math-for-index-names-date-range-possible/55044)
**Author:** [@alienmind](https://discuss.elastic.co/u/alienmind)\ **Replies:** 1\ **Last updated:** [July 14, 2016, 9:45am UTC](https://discuss.elastic.co/t/date-math-for-index-names-date-range-possible/55044 "2016-07-14T09:45:09Z")
EDIT: The question could be rephrased also as: When working with date based indexes, Is it any better to provide the exact indexes for searching (potentially a huge list): GET /whatever-YYYYMM01,whatever-YYYYMM02,... … --- ## [How can i do Elastic Search on Encrypted data](https://discuss.elastic.co/t/how-can-i-do-elastic-search-on-encrypted-data/95683)
**Author:** [@gauravgarg](https://discuss.elastic.co/u/gauravgarg)\ **Replies:** 6\ **Last updated:** [August 3, 2017, 11:53am UTC](https://discuss.elastic.co/t/how-can-i-do-elastic-search-on-encrypted-data/95683 "2017-08-03T11:53:43Z")
Hi team, I am new to elastic search. I am having one application where all of my data stored in encrypted form. I need to do elastic search on this encrypted data. Is it possible i can achieve ES on encrypted data ? I… --- ## [How to store kibana dashboard in docker container?](https://discuss.elastic.co/t/how-to-store-kibana-dashboard-in-docker-container/137459)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 8\ **Last updated:** [July 6, 2018, 4:06pm UTC](https://discuss.elastic.co/t/how-to-store-kibana-dashboard-in-docker-container/137459 "2018-07-06T16:06:08Z")
If the kibana is storing the dashboard in ES .kibana index then how can i save the dashboard so that users after spinning up the ELK using docker-compsoe can access the dashboard? I know volume is used for persistent sto… --- ## [Multiple parents in parent/child mapping](https://discuss.elastic.co/t/multiple-parents-in-parent-child-mapping/38769)
**Author:** [@MrIncredible](https://discuss.elastic.co/u/MrIncredible)\ **Replies:** 5\ **Last updated:** [January 9, 2016, 3:27pm UTC](https://discuss.elastic.co/t/multiple-parents-in-parent-child-mapping/38769 "2016-01-09T15:27:22Z")
Hi everyone, I've read quite a lot of elastic search these days, but I can't seem to find a solution to this problem... So here I am! I want to have the following mappings (we are here talking about parent/child mapp… --- ## [Order of output fields](https://discuss.elastic.co/t/order-of-output-fields/152683)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 0\ **Last updated:** [October 16, 2018, 2:33pm UTC](https://discuss.elastic.co/t/order-of-output-fields/152683 "2018-10-16T14:33:13Z")
Can I use the Logstash to change the order of the fields in a message and generate as a new message to output file? If yes, How can I did it? In the Filter or in the output section? Thanks Sharon. --- ## [TransportClient createInjector error](https://discuss.elastic.co/t/transportclient-createinjector-error/28571)
**Author:** [@guiltyxsin](https://discuss.elastic.co/u/guiltyxsin)\ **Replies:** 8\ **Last updated:** [December 19, 2015, 5:57am UTC](https://discuss.elastic.co/t/transportclient-createinjector-error/28571 "2015-12-19T05:57:32Z")
Hi All, I am new to Elasticsearch and I am currently having this error when using ES2. The error happens when Injector is being created during Node creation via NodeBuilder. The error is: Method threw 'java.lang.Stac… --- ## [Creating Tabs in Kibana Dashboard](https://discuss.elastic.co/t/creating-tabs-in-kibana-dashboard/47122)
**Author:** [@Pavithrananda\_Prabhu](https://discuss.elastic.co/u/Pavithrananda_Prabhu)\ **Replies:** 5\ **Last updated:** [May 5, 2016, 5:42am UTC](https://discuss.elastic.co/t/creating-tabs-in-kibana-dashboard/47122 "2016-05-05T05:42:52Z")
I currently have a Dashboard but i would like to split the Visualization in to various Tabs in Kibana.. I saw in one of the topics that a Mark down Widget can do this.. Please let me know how this can using markdown w… --- ## [Assign colors to boolean pie chart](https://discuss.elastic.co/t/assign-colors-to-boolean-pie-chart/294486)
**Author:** [@kequach](https://discuss.elastic.co/u/kequach)\ **Replies:** 6\ **Last updated:** [January 17, 2022, 2:54pm UTC](https://discuss.elastic.co/t/assign-colors-to-boolean-pie-chart/294486 "2022-01-17T14:54:44Z")
I want to have fixed colors for true/false. At the moment, the color palette simply assigns the bigger value to the default color which makes it hard to tell in one glance if the piechart is mostly false or true: I al… --- ## [Only can bind logstash http\_address to 127.0.0.1](https://discuss.elastic.co/t/only-can-bind-logstash-http-address-to-127-0-0-1/81413)
**Author:** [@batrako](https://discuss.elastic.co/u/batrako)\ **Replies:** 4\ **Last updated:** [April 12, 2017, 5:41am UTC](https://discuss.elastic.co/t/only-can-bind-logstash-http-address-to-127-0-0-1/81413 "2017-04-12T05:41:24Z")
I'm trying access to monitornig API from outside of logstash server but always bind to 127.0.0.1:9600 . In my logstash.yml config i set http.host with dns, ip,... but always bind to 127.0.0.1:9600. one of my example … --- ## [How to get documents from the buckets in terms aggregation?](https://discuss.elastic.co/t/how-to-get-documents-from-the-buckets-in-terms-aggregation/29239)
**Author:** [@siddharth\_gupta](https://discuss.elastic.co/u/siddharth_gupta)\ **Replies:** 3\ **Last updated:** [September 15, 2015, 1:33pm UTC](https://discuss.elastic.co/t/how-to-get-documents-from-the-buckets-in-terms-aggregation/29239 "2015-09-15T13:33:56Z")
Hello, I am using terms aggregation for only one field. I do get the proper results. But the thing is I want to get the documents present in every bucket. (right now i am getting only the count) For example: key\_1 … --- ## [I can't upload the sample accounts.json file](https://discuss.elastic.co/t/i-cant-upload-the-sample-accounts-json-file/109866)
**Author:** [@Daniel\_Gonzalez1](https://discuss.elastic.co/u/Daniel_Gonzalez1)\ **Replies:** 2\ **Last updated:** [December 1, 2017, 5:39am UTC](https://discuss.elastic.co/t/i-cant-upload-the-sample-accounts-json-file/109866 "2017-12-01T05:39:47Z")
Hello I'm new in Elastic. I'm using Elastic from a Mac. I want to upload de account.json file to elasticsearch with the following command as the documentation says. \_curl -H "Content-Type: application/json" -XPOST 'loc… --- ## [Set mandatory field in template mapping](https://discuss.elastic.co/t/set-mandatory-field-in-template-mapping/49100)
**Author:** [@lilu1](https://discuss.elastic.co/u/lilu1)\ **Replies:** 7\ **Last updated:** [December 13, 2016, 2:03pm UTC](https://discuss.elastic.co/t/set-mandatory-field-in-template-mapping/49100 "2016-12-13T14:03:01Z")
Hi, I know this is a old topic. I found the similar question in the following link. That question was asked in 2013. I just want to confirm the latest elasticsearch 2.3 still does not support setting the mandatory fie… --- ## [Include/exclude fields in Kibana visualization](https://discuss.elastic.co/t/include-exclude-fields-in-kibana-visualization/56032)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 1\ **Last updated:** [July 21, 2016, 4:38pm UTC](https://discuss.elastic.co/t/include-exclude-fields-in-kibana-visualization/56032 "2016-07-21T16:38:25Z")
Hi, I want to exclude some fields in Kibana when using the visualization tools. I see that there is a Include/exclude pattern and but I am not sure what syntax it uses? I couldn't find any info online. Can someone help? --- ## [How to integrate Kibana (OpenSource) with keycloak?](https://discuss.elastic.co/t/how-to-integrate-kibana-opensource-with-keycloak/222955)
**Author:** [@kavinraj305](https://discuss.elastic.co/u/kavinraj305)\ **Replies:** 3\ **Last updated:** [March 12, 2020, 10:05am UTC](https://discuss.elastic.co/t/how-to-integrate-kibana-opensource-with-keycloak/222955 "2020-03-12T10:05:01Z")
I am trying to integrate my open source kibana with keycloak. Kindly provide me some best approaches ? --- ## [Generating a url that contains a query](https://discuss.elastic.co/t/generating-a-url-that-contains-a-query/159134)
**Author:** [@Dafna\_Frank](https://discuss.elastic.co/u/Dafna_Frank)\ **Replies:** 4\ **Last updated:** [December 4, 2018, 6:17am UTC](https://discuss.elastic.co/t/generating-a-url-that-contains-a-query/159134 "2018-12-04T06:17:29Z")
Hi, I would like to automatically create a url and pass to my users so they could see the results of the query from Kibana. The query needs to contains something similar to this: { "query": { "match": { "kubernetes.… --- ## [Convert String to float failed](https://discuss.elastic.co/t/convert-string-to-float-failed/32232)
**Author:** [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\ **Replies:** 3\ **Last updated:** [October 15, 2015, 7:27am UTC](https://discuss.elastic.co/t/convert-string-to-float-failed/32232 "2015-10-15T07:27:21Z")
My logstash config: filter { grok { match =\> {"stack\_trace" =\> "%{JAVACLASS:exception\_class}: \\\[%{DATA:error\_level}\\\]\\\[%{BASE10NUM:error\_code}\\\]-%{GREEDYDATA:error\_message}"} } grok { match =\> {"message" … --- ## [Filebeats not sending logs to Logstash to be viewed in stdout](https://discuss.elastic.co/t/filebeats-not-sending-logs-to-logstash-to-be-viewed-in-stdout/263051)
**Author:** [@Juunis](https://discuss.elastic.co/u/Juunis)\ **Replies:** 7\ **Last updated:** [February 3, 2021, 9:31pm UTC](https://discuss.elastic.co/t/filebeats-not-sending-logs-to-logstash-to-be-viewed-in-stdout/263051 "2021-02-03T21:31:48Z")
Hi guys I'm new to the Elastic stack and I'm currently trying to setup a quick and easy pipeline between Logstash and Filebeats where filebeat will send a test log file and logstash will display it on stdout. Currently n… --- ## [Using 'painless' script to add / append to a nested field](https://discuss.elastic.co/t/using-painless-script-to-add-append-to-a-nested-field/57290)
**Author:** [@cmcc](https://discuss.elastic.co/u/cmcc)\ **Replies:** 3\ **Last updated:** [August 5, 2016, 5:50pm UTC](https://discuss.elastic.co/t/using-painless-script-to-add-append-to-a-nested-field/57290 "2016-08-05T17:50:03Z")
Using 5.0.0-alpha4: I've come across this in the elasticsearch repo, which is helpful, although not all the examples work. The one that tries to append a tag "blue" to the existing field "tags":\["red"\] fails with an er… --- ## [Cell Backgroud color instead of field text fore/back color](https://discuss.elastic.co/t/cell-backgroud-color-instead-of-field-text-fore-back-color/59454)
**Author:** [@prabhuramsoft](https://discuss.elastic.co/u/prabhuramsoft)\ **Replies:** 1\ **Last updated:** [August 31, 2016, 6:04pm UTC](https://discuss.elastic.co/t/cell-backgroud-color-instead-of-field-text-fore-back-color/59454 "2016-08-31T18:04:02Z")
Am able to achieve only highlighting the field text fore/Back color using color scripted field. If the condition is satisfied like 0%-Green, 1-50%-Yellow 76-99% - Orange & 100%-Red achieved using color scripted field. … --- ## [Enforce Timezone in Elastic Search Index](https://discuss.elastic.co/t/enforce-timezone-in-elastic-search-index/53719)
**Author:** [@BrendanThompson](https://discuss.elastic.co/u/BrendanThompson)\ **Replies:** 1\ **Last updated:** [June 24, 2016, 1:11am UTC](https://discuss.elastic.co/t/enforce-timezone-in-elastic-search-index/53719 "2016-06-24T01:11:33Z")
I have net flow data that's DateTime is in local timezone (GMT+10). However when elastic search creates the index it assumes that the data is in UTC, therefore all my times are skewed. Just wondering if there is a way to… --- ## [After X-Pack license expiration](https://discuss.elastic.co/t/after-x-pack-license-expiration/78072)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 5\ **Last updated:** [March 10, 2017, 5:26am UTC](https://discuss.elastic.co/t/after-x-pack-license-expiration/78072 "2017-03-10T05:26:34Z")
Hi, Once the license expires this is what happens. I am interested in this part. # Commercial plugins operate with reduced functionality on license expiration: # - security What changes with respect to security. Ther… --- ## [Where do is set setup.ilm.overwrite: true](https://discuss.elastic.co/t/where-do-is-set-setup-ilm-overwrite-true/245565)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 2\ **Last updated:** [August 20, 2020, 12:58pm UTC](https://discuss.elastic.co/t/where-do-is-set-setup-ilm-overwrite-true/245565 "2020-08-20T12:58:04Z")
Hello, filebeat setup shows me that Overwriting ILM policy is disabled, it also shows me how to enable it, but i do not know where to set it, can anyone point me to the right file? \[root@ELASTIC99004 ~\]# filebeat setup… --- ## [Running Filebeat from Command Line](https://discuss.elastic.co/t/running-filebeat-from-command-line/98907)
**Author:** [@dolanmk](https://discuss.elastic.co/u/dolanmk)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 8:14pm UTC](https://discuss.elastic.co/t/running-filebeat-from-command-line/98907 "2017-08-30T20:14:34Z")
Hi, I am hoping to run Filebeat from my command line and not as a service on my Windows machine. I have filebeat.yml configured to send my logs to a port that my Logstash will be listening for instead of sending them d… --- ## [Cannot connect to kibana through port 5601](https://discuss.elastic.co/t/cannot-connect-to-kibana-through-port-5601/277288)
**Author:** [@cfiske1](https://discuss.elastic.co/u/cfiske1)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 4:31pm UTC](https://discuss.elastic.co/t/cannot-connect-to-kibana-through-port-5601/277288 "2021-06-29T16:31:20Z")
I am trying to implement kibana and elasticsearch on an azure VM, and while I can get both of them running, I am unable to connect with kibana. After starting both programs, kibana gives me the message " log \[05:14:15… --- ## [Stuck with too many open files issue](https://discuss.elastic.co/t/stuck-with-too-many-open-files-issue/200809)
**Author:** [@yelabbas](https://discuss.elastic.co/u/yelabbas)\ **Replies:** 2\ **Last updated:** [September 25, 2019, 7:29am UTC](https://discuss.elastic.co/t/stuck-with-too-many-open-files-issue/200809 "2019-09-25T07:29:53Z")
Hello Elasticsearch community, We're stuck while trying to recover our Elasticsearch instance. Here's our situation : We deployed some months ago an instance (1 node only) of elasticsearch in a Kubernetes cluster. (… --- ## [Split charts and their own X-Axis](https://discuss.elastic.co/t/split-charts-and-their-own-x-axis/32460)
**Author:** [@logilouis](https://discuss.elastic.co/u/logilouis)\ **Replies:** 6\ **Last updated:** [October 29, 2015, 4:34am UTC](https://discuss.elastic.co/t/split-charts-and-their-own-x-axis/32460 "2015-10-29T04:34:37Z")
Hi guys! I have few APIs and each of them have multiple endpoints (like function/method name). I created a vertical bar chart, split chart (row) using API name, and X-Axis associated with the endpoints.The Y-Axis is si… --- ## [Unable to launch logstash and ingest data - Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/\_xpack'](https://discuss.elastic.co/t/unable-to-launch-logstash-and-ingest-data-got-response-code-401-contacting-elasticsearch-at-url-http-localhost-9200-xpack/134522)
**Author:** [@soumya\_sahoo](https://discuss.elastic.co/u/soumya_sahoo)\ **Replies:** 4\ **Last updated:** [June 6, 2018, 6:59am UTC](https://discuss.elastic.co/t/unable-to-launch-logstash-and-ingest-data-got-response-code-401-contacting-elasticsearch-at-url-http-localhost-9200-xpack/134522 "2018-06-06T06:59:34Z")
Hi team, Let me provide a short background to this - I was able to successfully ingest data to the engine using logstash. It is only after installing x-pack that I run into the following error stack upon passing the fol… --- ## [Field max size](https://discuss.elastic.co/t/field-max-size/60236)
**Author:** [@esther90](https://discuss.elastic.co/u/esther90)\ **Replies:** 1\ **Last updated:** [September 11, 2016, 9:40pm UTC](https://discuss.elastic.co/t/field-max-size/60236 "2016-09-11T21:40:14Z")
Hi all, I am currently using Elasticsearch and would like to check on whether will it be possible to check the max characters that I can place in the String field of a document? Is there any way I can define the max cha… --- ## [Elasticsearch on ZFS best practice](https://discuss.elastic.co/t/elasticsearch-on-zfs-best-practice/17470)
**Author:** [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)\ **Replies:** 7\ **Last updated:** [January 11, 2017, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-on-zfs-best-practice/17470 "2017-01-11T09:27:25Z")
Hello, I'm running an Elasticsearch node on a FreeBSD server, on top of ZFS storage. For now I've considered that ES is smart and manages its own cache, so I've disabled primary cache for data, leaving only metadata b… --- ## [LogStatsh- Grok Filter for Special character in the log file](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360)
**Author:** [@Bheeshma](https://discuss.elastic.co/u/Bheeshma)\ **Replies:** 8\ **Last updated:** [March 16, 2018, 4:10pm UTC](https://discuss.elastic.co/t/logstatsh-grok-filter-for-special-character-in-the-log-file/120360 "2018-03-16T16:10:53Z")
Hi, I have the below log pattern in a single line and trying to filter this from massive log using GROK FIlter 2018-02-17 17:00:12.7280 Information |||| Application: Hyperion |||| User: Teddy |||| Template: Homepage |… --- ## [How to specify time range in URI query?](https://discuss.elastic.co/t/how-to-specify-time-range-in-uri-query/59539)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 3\ **Last updated:** [September 2, 2016, 2:37am UTC](https://discuss.elastic.co/t/how-to-specify-time-range-in-uri-query/59539 "2016-09-02T02:37:26Z")
Hi, I need to use URI type of query string format (not the -d json type), and I need to specify the time range in the search string, but not sure how. this works nicely: curl -s -XGET ".../logstash-\*/\_search?size=5&q=… --- ## [How to export and Import Indexes and searches for Kibana using API?](https://discuss.elastic.co/t/how-to-export-and-import-indexes-and-searches-for-kibana-using-api/188018)
**Author:** [@shriharsha](https://discuss.elastic.co/u/shriharsha)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 10:47am UTC](https://discuss.elastic.co/t/how-to-export-and-import-indexes-and-searches-for-kibana-using-api/188018 "2019-07-01T10:47:09Z")
I want to export and Import Kibana Indexes and Searches in to a json file using APIs. Can we do that? If so, how? --- ## [Issue parsing nested JSON](https://discuss.elastic.co/t/issue-parsing-nested-json/26097)
**Author:** [@Jakauppila](https://discuss.elastic.co/u/Jakauppila)\ **Replies:** 6\ **Last updated:** [July 22, 2015, 10:40pm UTC](https://discuss.elastic.co/t/issue-parsing-nested-json/26097 "2015-07-22T22:40:23Z")
I am having issues parsing the second nested json event message coming from NXLog using Logstash 1.5.3. I have configured NXLog to ship my Log4Net app logs to a Logstash collector via TCP. From that collector, I ship th… --- ## [Failed to process cluster event (put-mapping)](https://discuss.elastic.co/t/failed-to-process-cluster-event-put-mapping/150354)
**Author:** [@Atthota](https://discuss.elastic.co/u/Atthota)\ **Replies:** 4\ **Last updated:** [September 28, 2018, 4:09pm UTC](https://discuss.elastic.co/t/failed-to-process-cluster-event-put-mapping/150354 "2018-09-28T16:09:51Z")
Hi, I have below issue from kibana , Any help appreciated. org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping) within 30s at org.elasticsearch.cluster.s… --- ## [Caused by: java.lang.NoClassDefFoundError: org/elasticsearch/common/xcontent/DeprecationHandler](https://discuss.elastic.co/t/caused-by-java-lang-noclassdeffounderror-org-elasticsearch-common-xcontent-deprecationhandler/149553)
**Author:** [@Pankaj\_Sharma](https://discuss.elastic.co/u/Pankaj_Sharma)\ **Replies:** 3\ **Last updated:** [September 27, 2018, 7:09am UTC](https://discuss.elastic.co/t/caused-by-java-lang-noclassdeffounderror-org-elasticsearch-common-xcontent-deprecationhandler/149553 "2018-09-27T07:09:06Z")
Hi, I am building a very basic spring app using java elasticsearch high level client. I have following elastic search dependency in build.gradle. compile 'org.elasticsearch.client:elasticsearch-rest-high-level-client:6… --- ## [We are trialling - feedback from others please](https://discuss.elastic.co/t/we-are-trialling-feedback-from-others-please/146080)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 0\ **Last updated:** [August 26, 2018, 10:31pm UTC](https://discuss.elastic.co/t/we-are-trialling-feedback-from-others-please/146080 "2018-08-26T22:31:58Z")
Hi All, We are internally trialling ECE, we've been a customer of Elastic Cloud for a while and wanted to get feedback from customers using ECE. What is going well? What isn't going so well? What size of environment do… --- ## [How to check logstash sends logs?](https://discuss.elastic.co/t/how-to-check-logstash-sends-logs/77314)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 4\ **Last updated:** [March 7, 2017, 5:56pm UTC](https://discuss.elastic.co/t/how-to-check-logstash-sends-logs/77314 "2017-03-07T17:56:55Z")
Hi, In Kibana I don't recieve any logs so I can't start with the dashboard. How can I check that Logstash is sending something to Elasticsearch? Thanks --- ## [Use field name in datastream namespace or dataset](https://discuss.elastic.co/t/use-field-name-in-datastream-namespace-or-dataset/302188)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 8:17am UTC](https://discuss.elastic.co/t/use-field-name-in-datastream-namespace-or-dataset/302188 "2022-04-14T08:17:11Z")
I'm trying to use a field with logstash output to Elasticsearch but I can't seem to get this to work. My configuration is as below: output { elasticsearch { hosts =\> "es01" data\_stream =\> "true" data… --- ## [Script field to subtract dates, compute time difference, not working](https://discuss.elastic.co/t/script-field-to-subtract-dates-compute-time-difference-not-working/116217)
**Author:** [@sijakret](https://discuss.elastic.co/u/sijakret)\ **Replies:** 2\ **Last updated:** [January 19, 2018, 3:56pm UTC](https://discuss.elastic.co/t/script-field-to-subtract-dates-compute-time-difference-not-working/116217 "2018-01-19T15:56:27Z")
hi, i am trying to compute a date difference in a scripted field if(!doc\['lastseen'\].empty && !doc\['firstseen'\].empty) { return doc\['lastseen'\].value - doc\['firstseen'\].value } else { return 0 } first seen and last … --- ## [How to enable kibana\_system user for kibana application](https://discuss.elastic.co/t/how-to-enable-kibana-system-user-for-kibana-application/263949)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 6\ **Last updated:** [February 12, 2021, 5:20am UTC](https://discuss.elastic.co/t/how-to-enable-kibana-system-user-for-kibana-application/263949 "2021-02-12T05:20:00Z")
Hi Team, We have one EFK stack running on 7.4.X version with X-pack security enabled and we defined elastic user for kibana application and everything works so far. Now we are trying to use 7.9 version of EFK with same… [Previous page](https://discuss.elastic.co/top.md?page=319&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=321&per_page=50&period=all)