# Top **URL:** https://discuss.elastic.co/top.md?page=335&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 336 --- ## [Logstahs behavior about empty lines](https://discuss.elastic.co/t/logstahs-behavior-about-empty-lines/98971)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 8\ **Last updated:** [August 31, 2017, 3:11pm UTC](https://discuss.elastic.co/t/logstahs-behavior-about-empty-lines/98971 "2017-08-31T15:11:22Z")
Hello, I want know how logstash interprete empty lines in a flat file. I must to place a particular option (see my filter below) or by itself he will ignore them? I retrive file and I apply a csv filter on it. I delete… --- ## [Elasticsearch 2.3.4, Logstash 2.3.4 and Kibana 4.5.2 and 4.1.9 released](https://discuss.elastic.co/t/elasticsearch-2-3-4-logstash-2-3-4-and-kibana-4-5-2-and-4-1-9-released/54974)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [July 7, 2016, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-2-3-4-logstash-2-3-4-and-kibana-4-5-2-and-4-1-9-released/54974 "2016-07-07T17:02:21Z")
Hi all, we are pleased to announce bug fix releases for the following products: Elasticsearch 2.3.4 Blog: https://www.elastic.co/blog/elasticsearch-2-3-4-released Download: https://www.elastic.co/downloads/elasticsearc… --- ## [LogStash Json ParserError Unexpected character ('t' (code 116)) : was expecting comma to separate Object entries](https://discuss.elastic.co/t/logstash-json-parsererror-unexpected-character-t-code-116-was-expecting-comma-to-separate-object-entries/147860)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 4\ **Last updated:** [September 10, 2018, 10:09am UTC](https://discuss.elastic.co/t/logstash-json-parsererror-unexpected-character-t-code-116-was-expecting-comma-to-separate-object-entries/147860 "2018-09-10T10:09:55Z")
please Help me please. I want to send a log with JSON format from rsyslog to logsatsh and then from logstash to graylog. All the steps I have done. step 1 : config /etc/rsyslog.conf \*.\* action(type="omfwd" target=… --- ## [How to avoid 30,000ms timeout during reindexing](https://discuss.elastic.co/t/how-to-avoid-30-000ms-timeout-during-reindexing/231370)
**Author:** [@deepak643](https://discuss.elastic.co/u/deepak643)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 6:27pm UTC](https://discuss.elastic.co/t/how-to-avoid-30-000ms-timeout-during-reindexing/231370 "2020-05-06T18:27:14Z")
While performing reindex operation, I am setting the request timeout to be 60 mins as below request.setTimeout(TimeValue. timeValueMinutes (60)); With the above config in place my request is still timing out for 30,000… --- ## [Setting Logstash LS\_JAVA\_OPTS in docker not reflecting in container](https://discuss.elastic.co/t/setting-logstash-ls-java-opts-in-docker-not-reflecting-in-container/210187)
**Author:** [@jdronde](https://discuss.elastic.co/u/jdronde)\ **Replies:** 2\ **Last updated:** [December 4, 2019, 10:16am UTC](https://discuss.elastic.co/t/setting-logstash-ls-java-opts-in-docker-not-reflecting-in-container/210187 "2019-12-04T10:16:50Z")
Hi All, I hope that this is an easy one and something that i am doing wrong in my compose file to easily fix it. But basically in my compose file for logstash i am setting the environment value to LS\_JAVA\_OPTS logst… --- ## [Top N records](https://discuss.elastic.co/t/top-n-records/159860)
**Author:** [@Rashmi\_Nagpal](https://discuss.elastic.co/u/Rashmi_Nagpal)\ **Replies:** 3\ **Last updated:** [December 7, 2018, 10:57am UTC](https://discuss.elastic.co/t/top-n-records/159860 "2018-12-07T10:57:48Z")
Hi there, Can someone guide me how to extract top five records from elasticsearch,I've used size query as well, but it returns all the documents. Goal is to get data in json format after sorting on basis of store size … --- ## [Logstash http\_poller POST Syntax](https://discuss.elastic.co/t/logstash-http-poller-post-syntax/51674)
**Author:** [@pramodxyle](https://discuss.elastic.co/u/pramodxyle)\ **Replies:** 1\ **Last updated:** [November 18, 2016, 7:39pm UTC](https://discuss.elastic.co/t/logstash-http-poller-post-syntax/51674 "2016-11-18T19:39:45Z")
Hi, I am trying to POST data to a REST API and get the response back in logstash and output it to elastic. What is the syntax to POST data ? Is this correct ? http\_poller { urls =\> { url1 =\> { … --- ## [1 of 105 shards failed with kibana 7.2.0](https://discuss.elastic.co/t/1-of-105-shards-failed-with-kibana-7-2-0/193756)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 7\ **Last updated:** [August 7, 2019, 3:12pm UTC](https://discuss.elastic.co/t/1-of-105-shards-failed-with-kibana-7-2-0/193756 "2019-08-07T15:12:48Z")
Hello, I have a elastic cloud deployment with the elasticsearch and the kibana associated with. I have also a on-premise kibana instance ( idem: 7.2.0, see conf below ) I create some index patterns that refers to sever… --- ## [Stuck pending elasticdeployment pods](https://discuss.elastic.co/t/stuck-pending-elasticdeployment-pods/249384)
**Author:** [@javig12](https://discuss.elastic.co/u/javig12)\ **Replies:** 5\ **Last updated:** [September 24, 2020, 8:14am UTC](https://discuss.elastic.co/t/stuck-pending-elasticdeployment-pods/249384 "2020-09-24T08:14:35Z")
Hello community, Executing the command: kubectl get eventss -w got this events: 0s Warning FailedScheduling pod/quickstart-es-default-0 0/3 nodes are availab… --- ## [Logstash - mutate - add\_field problem](https://discuss.elastic.co/t/logstash-mutate-add-field-problem/65665)
**Author:** [@Nadir](https://discuss.elastic.co/u/Nadir)\ **Replies:** 4\ **Last updated:** [November 10, 2016, 1:57pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-problem/65665 "2016-11-10T13:57:06Z")
Hi ! I do have the following event and I want to add another field and populate this with the content of event\_data.IpAddress: { "process\_id" =\> 476, "level" =\> "Information", "event\_data" =\> { … --- ## [Http client did not trust this server's certificate](https://discuss.elastic.co/t/http-client-did-not-trust-this-servers-certificate/109144)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 3\ **Last updated:** [December 3, 2017, 9:33pm UTC](https://discuss.elastic.co/t/http-client-did-not-trust-this-servers-certificate/109144 "2017-12-03T21:33:16Z")
HI aLL, Iam using certgen for generating certificates ,am able to use it , I knw its self signed certificate so browser tells me its not secured and i added exception, is there any way to stop the elasticsearch warn lo… --- ## [Logstash crashing with "Too many files open"](https://discuss.elastic.co/t/logstash-crashing-with-too-many-files-open/36479)
**Author:** [@vtst2412](https://discuss.elastic.co/u/vtst2412)\ **Replies:** 8\ **Last updated:** [December 10, 2015, 7:43pm UTC](https://discuss.elastic.co/t/logstash-crashing-with-too-many-files-open/36479 "2015-12-10T19:43:38Z")
I have two logstash nodes running with 8 cores each. However, they consistently crash (every 1 or 2 days) with "Too many files open". I've only been able to find cases of this message on ES, has anyone encountered this o… --- ## [Upgraded to 6.0.0 - Elasticsearch plugin is red](https://discuss.elastic.co/t/upgraded-to-6-0-0-elasticsearch-plugin-is-red/107679)
**Author:** [@undelete](https://discuss.elastic.co/u/undelete)\ **Replies:** 6\ **Last updated:** [November 17, 2017, 10:48am UTC](https://discuss.elastic.co/t/upgraded-to-6-0-0-elasticsearch-plugin-is-red/107679 "2017-11-17T10:48:21Z")
I just updated to 6.0.0 from 5.6.3 and now my Elasticsearch plugin is red. plugin:elasticsearch@6.0.0  Your Kibana index is out of date, reset it or use the X-Pack upgrade assistant. I have searched for resetting kiba… --- ## [How To Change Kibana Theme or RYO?](https://discuss.elastic.co/t/how-to-change-kibana-theme-or-ryo/81596)
**Author:** [@initproto](https://discuss.elastic.co/u/initproto)\ **Replies:** 4\ **Last updated:** [April 7, 2017, 5:32pm UTC](https://discuss.elastic.co/t/how-to-change-kibana-theme-or-ryo/81596 "2017-04-07T17:32:34Z")
Hi, I find the kibana colors and theme a bit unprofessional and kiddie-looking (like candy crush). Has any thought been put into the idea that people want to change the theme or branding with this version? In the past… --- ## [Unable to ingest apache2 logs through filebeat](https://discuss.elastic.co/t/unable-to-ingest-apache2-logs-through-filebeat/146309)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 7\ **Last updated:** [September 14, 2018, 2:25pm UTC](https://discuss.elastic.co/t/unable-to-ingest-apache2-logs-through-filebeat/146309 "2018-09-14T14:25:14Z")
Hi Team, I am trying to ingest the apache 2 access and error logs through the filebeat index and getting the below error ./filebeat -e -c filebeat.yml -d "publish" 2018-08-28T02:40:42.896-0700 INFO instance/beat.… --- ## [Timelion bar graph](https://discuss.elastic.co/t/timelion-bar-graph/83361)
**Author:** [@Padmavathy](https://discuss.elastic.co/u/Padmavathy)\ **Replies:** 3\ **Last updated:** [April 25, 2017, 4:42pm UTC](https://discuss.elastic.co/t/timelion-bar-graph/83361 "2017-04-25T16:42:23Z")
Is there a way to change the mode from stacked to grouped in a timelion chart.The graph i need with timelion is a bar chart. --- ## [How do I modify queue.mem.events property when the APM server is managed through Fleet integration?](https://discuss.elastic.co/t/how-do-i-modify-queue-mem-events-property-when-the-apm-server-is-managed-through-fleet-integration/294791)
**Author:** [@Yash\_Gill](https://discuss.elastic.co/u/Yash_Gill)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 7:09pm UTC](https://discuss.elastic.co/t/how-do-i-modify-queue-mem-events-property-when-the-apm-server-is-managed-through-fleet-integration/294791 "2022-02-02T19:09:39Z")
Kibana version: 7.16.2 Elasticsearch version: 7.16.2 APM Server version: 7.16.1 APM Agent language and version: .NET Standard 2.0 Browser version: NA Original install method (e.g. download page, yum, deb, from … --- ## [Is there a way to edit documents in Kibana?](https://discuss.elastic.co/t/is-there-a-way-to-edit-documents-in-kibana/139264)
**Author:** [@Kvin](https://discuss.elastic.co/u/Kvin)\ **Replies:** 3\ **Last updated:** [July 10, 2018, 6:33am UTC](https://discuss.elastic.co/t/is-there-a-way-to-edit-documents-in-kibana/139264 "2018-07-10T06:33:07Z")
I would like to know if there's a way to edit documents in Kibana's Discover tab. Either with a built in feature I've missed or with a plugin. So far I've failed to find anything like this, even though it feels like a pr… --- ## [Parse json file with logstash](https://discuss.elastic.co/t/parse-json-file-with-logstash/134795)
**Author:** [@Super8film](https://discuss.elastic.co/u/Super8film)\ **Replies:** 5\ **Last updated:** [June 11, 2018, 5:55am UTC](https://discuss.elastic.co/t/parse-json-file-with-logstash/134795 "2018-06-11T05:55:11Z")
hey I've following json file { "time":"2015-09-20;12:13:24", "bug\_code":"test", "stacktrace":1235 } I got this from a python script and logstash reading it out with following configuration: input { file{ pat… --- ## [What is segments.terms\_memory\_in\_bytes?](https://discuss.elastic.co/t/what-is-segments-terms-memory-in-bytes/68621)
**Author:** [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)\ **Replies:** 5\ **Last updated:** [December 12, 2016, 1:03pm UTC](https://discuss.elastic.co/t/what-is-segments-terms-memory-in-bytes/68621 "2016-12-12T13:03:57Z")
I use plugin head to monitor elasticsearch cluster, and I found that the segments.terms\_memory\_in\_bytes occupy most of the memory: "segments": { "count": 6813, "memory\_in\_bytes": 39858854460, "terms\_memory\_in\_bytes": … --- ## [Exclude particular fields from \[all\_field\] searches](https://discuss.elastic.co/t/exclude-particular-fields-from-all-field-searches/76837)
**Author:** [@niaz](https://discuss.elastic.co/u/niaz)\ **Replies:** 6\ **Last updated:** [March 9, 2017, 9:12pm UTC](https://discuss.elastic.co/t/exclude-particular-fields-from-all-field-searches/76837 "2017-03-09T21:12:34Z")
Hello, I want to use "all\_field" option in my queries to search all indexed fields, but excluding a few. I have elastic search 5.2.1 installed and sent below commands using Kibana to elastic search. PUT test\_index { … --- ## ["license","warning","xpack"](https://discuss.elastic.co/t/license-warning-xpack/192600)
**Author:** [@flyboyacsrao](https://discuss.elastic.co/u/flyboyacsrao)\ **Replies:** 8\ **Last updated:** [July 29, 2019, 11:11am UTC](https://discuss.elastic.co/t/license-warning-xpack/192600 "2019-07-29T11:11:49Z")
Hi Team I installed Elasticsearch 6.8 and kibana 6.8, with basic license, for some time both were working find. now i am unable to get my Kibana working, though the ES is green and i can see all my app logs being pumped… --- ## [Installation problems - Public key not available](https://discuss.elastic.co/t/installation-problems-public-key-not-available/300571)
**Author:** [@user111](https://discuss.elastic.co/u/user111)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 1:12pm UTC](https://discuss.elastic.co/t/installation-problems-public-key-not-available/300571 "2022-03-24T13:12:43Z")
Dear community, I´m trying to install the ELK Stack as explained in the official documentation here: I´m running a Ubuntu 18.04 machine and I´m getting the following error while executing sudo apt-get update && sudo a… --- ## [Logstash Could not index event to Elasticsearch The \[default\] mapping cannot be updated on index](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch-the-default-mapping-cannot-be-updated-on-index/177315)
**Author:** [@Moshe\_Nadler](https://discuss.elastic.co/u/Moshe_Nadler)\ **Replies:** 5\ **Last updated:** [May 3, 2019, 10:53am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch-the-default-mapping-cannot-be-updated-on-index/177315 "2019-05-03T10:53:00Z")
After an upgrade to elastic stack 7 Logstash cannot send logs to elasticsearch any more. We see the following error: \[2019-04-17T14:25:31,292\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearc… --- ## [Getting unauthorized access error in metricbeat](https://discuss.elastic.co/t/getting-unauthorized-access-error-in-metricbeat/186435)
**Author:** [@emnioj](https://discuss.elastic.co/u/emnioj)\ **Replies:** 3\ **Last updated:** [June 19, 2019, 11:43am UTC](https://discuss.elastic.co/t/getting-unauthorized-access-error-in-metricbeat/186435 "2019-06-19T11:43:06Z")
hi team, i am getting below error in metricbeat: 2019-06-19T11:39:50.528+0100 INFO \[monitoring\] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"tic… --- ## [Possible to manually delete S3 backup repository?](https://discuss.elastic.co/t/possible-to-manually-delete-s3-backup-repository/101402)
**Author:** [@Patrick\_Hannigan](https://discuss.elastic.co/u/Patrick_Hannigan)\ **Replies:** 8\ **Last updated:** [October 19, 2017, 1:29pm UTC](https://discuss.elastic.co/t/possible-to-manually-delete-s3-backup-repository/101402 "2017-10-19T13:29:40Z")
Hi all - we've started backing up our elasticsearch cluster into a new S3 bucket/repo and would like to delete the previous bucket/repo that we were using. However, when we try to delete the old repo, we're getting the e… --- ## [Class file for org.elasticsearch.common.xcontent.ToXContentObject not found](https://discuss.elastic.co/t/class-file-for-org-elasticsearch-common-xcontent-toxcontentobject-not-found/226928)
**Author:** [@Bengisu](https://discuss.elastic.co/u/Bengisu)\ **Replies:** 4\ **Last updated:** [April 8, 2020, 9:22am UTC](https://discuss.elastic.co/t/class-file-for-org-elasticsearch-common-xcontent-toxcontentobject-not-found/226928 "2020-04-08T09:22:05Z")
Hello, I am trying to configure the Java High Level REST Client by using https://www.elastic.co/guide/en/elasticsearch/client/java-rest/7.6/java-rest-high-getting-started-maven.html document. I am using gradle as a dep… --- ## [Error when installing fleet server](https://discuss.elastic.co/t/error-when-installing-fleet-server/274280)
**Author:** [@Jonathon\_Penn](https://discuss.elastic.co/u/Jonathon_Penn)\ **Replies:** 8\ **Last updated:** [June 10, 2021, 11:38am UTC](https://discuss.elastic.co/t/error-when-installing-fleet-server/274280 "2021-06-10T11:38:05Z")
When attempting to install a fleet server for a cluster running on an on-prem installation of Elastic Enterprise, I get the following error: user@fleet01:/opt/elastic-agent$ sudo elastic-agent enroll -f --fleet-server-e… --- ## [Is it possible to use String as \_id?](https://discuss.elastic.co/t/is-it-possible-to-use-string-as--id/17236)
**Author:** [@Yz1](https://discuss.elastic.co/u/Yz1)\ **Replies:** 3\ **Last updated:** [April 29, 2014, 4:13am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-string-as--id/17236 "2014-04-29T04:13:46Z")
Through my experiment, it seems not possible to use string as primary key in Elasticsearch. If type String is used , then the \_id will be something like this: "\_id":"\[B@fe583b" which uses the object address in jvm i… --- ## [ImportError: cannot import name ‘decodestring’ from ‘base64’ (/usr/lib64/python3.9/base64.py)](https://discuss.elastic.co/t/importerror-cannot-import-name-decodestring-from-base64-usr-lib64-python3-9-base64-py/262248)
**Author:** [@Green\_Max](https://discuss.elastic.co/u/Green_Max)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 12:53pm UTC](https://discuss.elastic.co/t/importerror-cannot-import-name-decodestring-from-base64-usr-lib64-python3-9-base64-py/262248 "2021-01-27T12:53:49Z")
can you help me to fix bug that says Traceback (most recent call last): File "/home/fofive/PycharmProjects/pythonProject/main.py", line 1, in \ from elasticsearch import Elasticsearch, RequestsH… --- ## [Failed to publish events caused by: write tcp 10.90.66.80:57738-\>10.90.66.48:5044: write: connection reset by peer](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-10-90-66-80-57738-10-90-66-48-write-connection-reset-by-peer/147632)
**Author:** [@fewknow](https://discuss.elastic.co/u/fewknow)\ **Replies:** 3\ **Last updated:** [September 7, 2018, 6:37pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-write-tcp-10-90-66-80-57738-10-90-66-48-write-connection-reset-by-peer/147632 "2018-09-07T18:37:02Z")
2018-09-06T16:26:36.086-0400 ERROR logstash/async.go:252 Failed to publish events caused by: write tcp 10.90.66.80:57738-\>10.90.66.48:5044: write: connection reset by peer 2018-09-06T16:26:37.086-0400 ERROR pipeline/out… --- ## [Aggregations return result with sum\_other\_doc\_count](https://discuss.elastic.co/t/aggregations-return-result-with-sum-other-doc-count/29578)
**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\ **Replies:** 2\ **Last updated:** [September 18, 2015, 4:06pm UTC](https://discuss.elastic.co/t/aggregations-return-result-with-sum-other-doc-count/29578 "2015-09-18T16:06:09Z")
When we are doing a terms aggregation we are getting buckets of keys but also some document count under "sum\_other\_doc\_count" Why are we getting this? How can we bucket these documents? --- ## [Failed to create monitoring event](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876)
**Author:** [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Replies:** 7\ **Last updated:** [February 17, 2017, 6:26am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876 "2017-02-17T06:26:10Z")
after configuring the X-PACK logstash is not processing the the logs configuration of logstash input { tcp { port =\> 5044 charset =\> "ISO-8859-1" } } filter { if \[type\] == "syslog" { gr… --- ## [JSON parse error, original data now in message field, even though its a valid json](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field-even-though-its-a-valid-json/149033)
**Author:** [@gopalkakularam](https://discuss.elastic.co/u/gopalkakularam)\ **Replies:** 1\ **Last updated:** [September 25, 2018, 1:26pm UTC](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field-even-though-its-a-valid-json/149033 "2018-09-25T13:26:57Z")
This is the json log posting to logstash: { "@version" : 1, "source\_host" : "Gopals-MacBook-Pro-3.local", "message" : "Loading source class org.springframework.cloud.bootstrap.config.PropertySourceBootstrapConfigurat… --- ## [ML What is the difference between by\_field\_name and partition\_field\_name](https://discuss.elastic.co/t/ml-what-is-the-difference-between-by-field-name-and-partition-field-name/108720)
**Author:** [@hym](https://discuss.elastic.co/u/hym)\ **Replies:** 1\ **Last updated:** [November 29, 2017, 5:28pm UTC](https://discuss.elastic.co/t/ml-what-is-the-difference-between-by-field-name-and-partition-field-name/108720 "2017-11-29T17:28:54Z")
Hi, In detector object configuration we have two fields by\_field\_name: used to split the data partition\_field\_name : used to segment the analyses what is the difference between them? Thanks in advance --- ## [Boolean must/should where field is optional in some documents](https://discuss.elastic.co/t/boolean-must-should-where-field-is-optional-in-some-documents/12145)
**Author:** [@Nick\_Dunn](https://discuss.elastic.co/u/Nick_Dunn)\ **Replies:** 8\ **Last updated:** [March 1, 2016, 5:28pm UTC](https://discuss.elastic.co/t/boolean-must-should-where-field-is-optional-in-some-documents/12145 "2016-03-01T17:28:16Z")
I can't quite get my head around a specific search requirement I have, so I hope someone can help. My documents have a field "published" with a string value "yes" or "no" (not boolean true/false, indexed data out … --- ## [How to send alert from ELK to SMS gateway?](https://discuss.elastic.co/t/how-to-send-alert-from-elk-to-sms-gateway/50647)
**Author:** [@gsronald](https://discuss.elastic.co/u/gsronald)\ **Replies:** 2\ **Last updated:** [June 1, 2016, 8:28am UTC](https://discuss.elastic.co/t/how-to-send-alert-from-elk-to-sms-gateway/50647 "2016-06-01T08:28:52Z")
Dear all, I would like to help my client to send ELK critical alert into SMS gateway and send SMS to the operator. May I know anyone got such experience and how to make it works? Can share a bit? Thanks for your … --- ## ["How to get the oldest document of all indexes matching an index pattern](https://discuss.elastic.co/t/how-to-get-the-oldest-document-of-all-indexes-matching-an-index-pattern/68542)
**Author:** [@Guido2016](https://discuss.elastic.co/u/Guido2016)\ **Replies:** 3\ **Last updated:** [December 27, 2016, 3:01pm UTC](https://discuss.elastic.co/t/how-to-get-the-oldest-document-of-all-indexes-matching-an-index-pattern/68542 "2016-12-27T15:01:21Z")
Hello, is there a solution to get this information? --- ## [Question about system.process.cpu.total.pct](https://discuss.elastic.co/t/question-about-system-process-cpu-total-pct/78926)
**Author:** [@misabel](https://discuss.elastic.co/u/misabel)\ **Replies:** 6\ **Last updated:** [March 22, 2017, 11:11am UTC](https://discuss.elastic.co/t/question-about-system-process-cpu-total-pct/78926 "2017-03-22T11:11:18Z")
Hi, If I look at the documentation for metricbeat I see the definition of system.process.cpu.total.pct as: The percentage of CPU time spent by the process since the last update. Its value is similar to the %CPU value o… --- ## [Configuring pipeline in filebeat module - nginx](https://discuss.elastic.co/t/configuring-pipeline-in-filebeat-module-nginx/162561)
**Author:** [@crazywizard](https://discuss.elastic.co/u/crazywizard)\ **Replies:** 3\ **Last updated:** [January 2, 2019, 2:12pm UTC](https://discuss.elastic.co/t/configuring-pipeline-in-filebeat-module-nginx/162561 "2019-01-02T14:12:35Z")
I'm trying to figure out how to configure a pipeline in my nginx filebeat module. This link https://www.elastic.co/guide/en/beats/filebeat/master/configuring-ingest-node.html shows a general top-level configuration for … --- ## [Elastic Beats as a superior log shipping service to NXlog?](https://discuss.elastic.co/t/elastic-beats-as-a-superior-log-shipping-service-to-nxlog/60324)
**Author:** [@rlonberg](https://discuss.elastic.co/u/rlonberg)\ **Replies:** 4\ **Last updated:** [September 23, 2016, 3:48pm UTC](https://discuss.elastic.co/t/elastic-beats-as-a-superior-log-shipping-service-to-nxlog/60324 "2016-09-23T15:48:59Z")
I am currently evaluating the benefits of replacing NXlog with winlogbeat as my primary service for remotely shipping logs from various windows servers to a linux logstash instance. Could someone help me understand why… --- ## [Request Timeout after 30000ms for kibana](https://discuss.elastic.co/t/request-timeout-after-30000ms-for-kibana/91711)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 6\ **Last updated:** [July 8, 2017, 4:13am UTC](https://discuss.elastic.co/t/request-timeout-after-30000ms-for-kibana/91711 "2017-07-08T04:13:05Z")
hi all I have 2 client node - 3 data node - 2 master node - kibana that connected to Client node. after one query that sends by kibana, it take more time and after that i get the following error in kibana : : " plug… --- ## [Elasticsearch Spark EsHadoopNoNodesLeftException in cluster Mode](https://discuss.elastic.co/t/elasticsearch-spark-eshadoopnonodesleftexception-in-cluster-mode/21367)
**Author:** [@rahulkumar\_aws](https://discuss.elastic.co/u/rahulkumar_aws)\ **Replies:** 6\ **Last updated:** [January 12, 2017, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-spark-eshadoopnonodesleftexception-in-cluster-mode/21367 "2017-01-12T07:23:00Z")
Hi, I am trying to index data trough apache spark to elasticsearch. Apache Spark is used for data enrichment and then i am using saveToEs to index data. Local mode my code is working fine, but when I run code on clu… --- ## [Shipping Postfix logs to ELK stack](https://discuss.elastic.co/t/shipping-postfix-logs-to-elk-stack/53667)
**Author:** [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Replies:** 3\ **Last updated:** [June 23, 2016, 6:05pm UTC](https://discuss.elastic.co/t/shipping-postfix-logs-to-elk-stack/53667 "2016-06-23T18:05:38Z")
Hello, Well this is not actually an issue rather query. I have been playing with ELK stack for a few days. I have a working ELK stack running on Ubuntu 16.04. Kibana has Marvel and Sense installed and working. I can sh… --- ## [Searching with & without spaces](https://discuss.elastic.co/t/searching-with-without-spaces/122076)
**Author:** [@iluvcode](https://discuss.elastic.co/u/iluvcode)\ **Replies:** 6\ **Last updated:** [March 1, 2018, 2:13pm UTC](https://discuss.elastic.co/t/searching-with-without-spaces/122076 "2018-03-01T14:13:04Z")
I am using Elasticsearch 5.3 and would like to get the same results if the words have space or without space. example : Some of the documents have "SM 58" (with space) and some have "SM58" (without space). So when I se… --- ## [Request Entity Too Large Exception](https://discuss.elastic.co/t/request-entity-too-large-exception/105987)
**Author:** [@ajit](https://discuss.elastic.co/u/ajit)\ **Replies:** 3\ **Last updated:** [November 1, 2017, 1:53pm UTC](https://discuss.elastic.co/t/request-entity-too-large-exception/105987 "2017-11-01T13:53:56Z")
I am getting below exception. org.elasticsearch.client.ResponseException: PUT http://172.21.153.176:9200/test2/jsonindextype/\_bulk: HTTP/1.1 413 Request Entity Too Large I am pushing 200000 records to elasticsearch but… --- ## [How to calculate time difference between 2 log lines for a unique ID](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-2-log-lines-for-a-unique-id/155870)
**Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 4\ **Last updated:** [November 28, 2018, 2:46am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-2-log-lines-for-a-unique-id/155870 "2018-11-28T02:46:26Z")
I need to calculate the difference in time between 2 log lines for http code 200. The difference should be done for a unique id. Please find the log line below. 2018/01/16 00:13:44.890 \[HCServiceImpl\] \[\*\*qtp5720769-243\*… --- ## [Kafka input plugin does not set @metadata fields](https://discuss.elastic.co/t/kafka-input-plugin-does-not-set-metadata-fields/125256)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 9:16pm UTC](https://discuss.elastic.co/t/kafka-input-plugin-does-not-set-metadata-fields/125256 "2018-03-22T21:16:12Z")
The kafka input plugin does not appear to set the @metadata fields as described in this Logstash documentation. I'm using Elasticsearch 6.2.2 and Logstash 6.2.2 on Docker images, running on a CentOS 7.4 server. I wante… --- ## [Logstash giving error while creating template - Failed to install template Got response code '400' contacting Elasticsearch at URL](https://discuss.elastic.co/t/logstash-giving-error-while-creating-template-failed-to-install-template-got-response-code-400-contacting-elasticsearch-at-url/307677)
**Author:** [@anand\_tripathi](https://discuss.elastic.co/u/anand_tripathi)\ **Replies:** 0\ **Last updated:** [June 20, 2022, 3:14pm UTC](https://discuss.elastic.co/t/logstash-giving-error-while-creating-template-failed-to-install-template-got-response-code-400-contacting-elasticsearch-at-url/307677 "2022-06-20T15:14:10Z")
I am getting this error failed to install when specifying the template file in the logstash configuration. But the same template json is working if I create it using the Elasticsearch API. I actually don't want to create… --- ## [Can't access localhost:9200 in browser](https://discuss.elastic.co/t/cant-access-localhost-9200-in-browser/35114)
**Author:** [@aqiao](https://discuss.elastic.co/u/aqiao)\ **Replies:** 4\ **Last updated:** [November 20, 2015, 6:19am UTC](https://discuss.elastic.co/t/cant-access-localhost-9200-in-browser/35114 "2015-11-20T06:19:34Z")
hi all, since the new elk version (elasticsearch 2.0,kibana 4.2.1 and logstash2.0) released,i removed the olded elk version(logstash 1.5,elasticsearch 1.5 and kibana 4.0). However,after i installed new version,i can't op… [Previous page](https://discuss.elastic.co/top.md?page=334&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=336&per_page=50&period=all)