# Top **URL:** https://discuss.elastic.co/top.md?page=343&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 344 --- ## [Zen-disco-receive](https://discuss.elastic.co/t/zen-disco-receive/28423)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 4\ **Last updated:** [September 2, 2015, 3:19am UTC](https://discuss.elastic.co/t/zen-disco-receive/28423 "2015-09-02T03:19:20Z")
what does below logging mean? is there a problem? xxxx is the server name Sep 01, 2015 7:07:26 PM org.elasticsearch.cluster.service.InternalClusterService$UpdateTask run INFO: \[logstash-xxxxx-2049-11632\] added {\[logsta… --- ## [Export Discovery to CSV as of 7.4](https://discuss.elastic.co/t/export-discovery-to-csv-as-of-7-4/203911)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 4:52pm UTC](https://discuss.elastic.co/t/export-discovery-to-csv-as-of-7-4/203911 "2019-10-17T16:52:44Z")
Trying to get updated information. I have the option to export data in a visualization, but I do not have the option on the Discover page with results from a query. Is this a paid option and/or does it require the Repo… --- ## [Solved: Timelion OR query](https://discuss.elastic.co/t/solved-timelion-or-query/95359)
**Author:** [@Olexij\_Tkatchenko](https://discuss.elastic.co/u/Olexij_Tkatchenko)\ **Replies:** 2\ **Last updated:** [August 1, 2017, 3:37pm UTC](https://discuss.elastic.co/t/solved-timelion-or-query/95359 "2017-08-01T15:37:10Z")
I’m trying to define a query in timelion: .es(index=rspec\_issue\_miner\_v1, q=priority.name.keyword:(Blocker OR Critical)) However I get an error Timelion: SyntaxError: {"type":"incompleteFunction","function":"es","loca… --- ## [Error FORBIDDEN/8/index write (api)\] and Elasticsearch stop to receiving logstash bulk requests](https://discuss.elastic.co/t/error-forbidden-8-index-write-api-and-elasticsearch-stop-to-receiving-logstash-bulk-requests/215028)
**Author:** [@ALEXANDRE\_BUNN1](https://discuss.elastic.co/u/ALEXANDRE_BUNN1)\ **Replies:** 7\ **Last updated:** [January 15, 2020, 10:16pm UTC](https://discuss.elastic.co/t/error-forbidden-8-index-write-api-and-elasticsearch-stop-to-receiving-logstash-bulk-requests/215028 "2020-01-15T22:16:55Z")
I have a server running Logstash, Kibana and ElasticSearch 6.8, all in the same server. I was setting up the ILM for the indexes, just to set a retention and executing force\_merge for the old indices (older than 1 day) … --- ## [How to increase Kibana Memory?](https://discuss.elastic.co/t/how-to-increase-kibana-memory/297204)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [February 28, 2022, 10:01pm UTC](https://discuss.elastic.co/t/how-to-increase-kibana-memory/297204 "2022-02-28T22:01:51Z")
Hello, How can i Increase the memory that Kibana uses? I tried following this part of the documentation, but it does not work, there is no change in the memory used in the monitoring. I want to use 4096 MB for Kibana,… --- ## [Kiabana graph for total count](https://discuss.elastic.co/t/kiabana-graph-for-total-count/27821)
**Author:** [@Sar82](https://discuss.elastic.co/u/Sar82)\ **Replies:** 6\ **Last updated:** [August 25, 2015, 12:36pm UTC](https://discuss.elastic.co/t/kiabana-graph-for-total-count/27821 "2015-08-25T12:36:25Z")
Hello, I want to create a graph for following sample input, Date, Name (can be TCP/UDP or any other), Packets In, Packets Out This graph will show network throughput of TCP packets, UDP packets and total of TCP and UDP… --- ## [Not able to multiline this Log on the basis of timestamp pattern](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833)
**Author:** [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Replies:** 8\ **Last updated:** [November 8, 2016, 5:11pm UTC](https://discuss.elastic.co/t/not-able-to-multiline-this-log-on-the-basis-of-timestamp-pattern/64833 "2016-11-08T17:11:19Z")
Greetings, I was trying to handle following kind of logs with multiline. I am not able to get all events starting from timestamp. Could somebody please help me in making a good multiline pattern to get all the stack tr… --- ## [Failed to obtain node locks, tried \[/usr/share/elasticsearch/data\]; maybe these locations are not writable or multiple nodes were started on the same data path?](https://discuss.elastic.co/t/failed-to-obtain-node-locks-tried-usr-share-elasticsearch-data-maybe-these-locations-are-not-writable-or-multiple-nodes-were-started-on-the-same-data-path/326264)
**Author:** [@limedong1](https://discuss.elastic.co/u/limedong1)\ **Replies:** 7\ **Last updated:** [February 23, 2023, 7:15am UTC](https://discuss.elastic.co/t/failed-to-obtain-node-locks-tried-usr-share-elasticsearch-data-maybe-these-locations-are-not-writable-or-multiple-nodes-were-started-on-the-same-data-path/326264 "2023-02-23T07:15:49Z")
I use k8s built a ela cluster, I in the yaml document data directory: / usr/share/elasticsearch/data local hostpath path is: / data/elasticsearch/data This is directory permission information: drwxr-xr-x. 3 1000 100… --- ## [Problems with role based access: x\_content\_parse\_exception](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 4\ **Last updated:** [September 17, 2018, 10:52am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796 "2018-09-17T10:52:49Z")
Hi guys, I'm facing a strange problem with role based access control. Here is my use case: INDEX DEFINITION { "invoices\_status" : { "aliases" : { }, "mappings" : { "status" : { "properties" : { "company" : { "t… --- ## [Unable to verify the first certificate on postman](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-on-postman/344071)
**Author:** [@stramzik](https://discuss.elastic.co/u/stramzik)\ **Replies:** 3\ **Last updated:** [September 29, 2023, 9:22am UTC](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-on-postman/344071 "2023-09-29T09:22:52Z")
Hi I've setup a Elastic and Kibana instance on Windows server Both instances are secured with LetsEncrypt certificate. When I try to use the elasticsearch API on POSTMAN i get the "Unable to verify the first certificate… --- ## [Visualize: Divide values of 2 filters](https://discuss.elastic.co/t/visualize-divide-values-of-2-filters/106028)
**Author:** [@Frank\_Matera](https://discuss.elastic.co/u/Frank_Matera)\ **Replies:** 3\ **Last updated:** [November 3, 2017, 3:26pm UTC](https://discuss.elastic.co/t/visualize-divide-values-of-2-filters/106028 "2017-11-03T15:26:51Z")
Running Kibana 5.6. What I would like to know if it is at all possible, to do (filter2/filter1)\*100 in another way (Completed/ATTEMPTS)\*100. I have tried multiple ways with no luck. Any help would be greatly appreciated… --- ## [Extract field from message field with in logs](https://discuss.elastic.co/t/extract-field-from-message-field-with-in-logs/167908)
**Author:** [@ray\_zuniga](https://discuss.elastic.co/u/ray_zuniga)\ **Replies:** 7\ **Last updated:** [February 15, 2019, 1:20pm UTC](https://discuss.elastic.co/t/extract-field-from-message-field-with-in-logs/167908 "2019-02-15T13:20:32Z")
im working with an elk stack that I did not deploy. I have an "index" for dns logs. it gives me a few default fields. The message field is given, but I noticed that the "client" and "query" with in it are things I would… --- ## [How to fix cluster is red, reason: no\_valid\_shard\_copy after stopping data nodes?](https://discuss.elastic.co/t/how-to-fix-cluster-is-red-reason-no-valid-shard-copy-after-stopping-data-nodes/291206)
**Author:** [@bugb](https://discuss.elastic.co/u/bugb)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39am UTC](https://discuss.elastic.co/t/how-to-fix-cluster-is-red-reason-no-valid-shard-copy-after-stopping-data-nodes/291206 "2021-12-09T07:39:33Z")
After stopping some data nodes, my cluster becomes red and the reason is: no\_valid\_shard\_copy after stopping data nodes? How can I fix this? Update: should I use reroute? POST \_cluster/reroute?retry\_failed --- ## [How to show data in tabular form without aggregation in kibana 4?](https://discuss.elastic.co/t/how-to-show-data-in-tabular-form-without-aggregation-in-kibana-4/1221)
**Author:** [@kitex](https://discuss.elastic.co/u/kitex)\ **Replies:** 1\ **Last updated:** [May 27, 2015, 4:28pm UTC](https://discuss.elastic.co/t/how-to-show-data-in-tabular-form-without-aggregation-in-kibana-4/1221 "2015-05-27T16:28:45Z")
I am trying to show number of servers down currently in kibana. \[image\] As for any server whose uptime is 1/1/1970 it is down. Is it possible to show data in this form? Also can I view servers down from certain time… --- ## [High load average running on ES node](https://discuss.elastic.co/t/high-load-average-running-on-es-node/15108)
**Author:** [@Arjit\_Gupta](https://discuss.elastic.co/u/Arjit_Gupta)\ **Replies:** 5\ **Last updated:** [January 9, 2014, 5:16am UTC](https://discuss.elastic.co/t/high-load-average-running-on-es-node/15108 "2014-01-09T05:16:01Z")
Hi, I have 4 node cluster for 32 Gb ram and 8 core processor. With 5 indexes and 5 primary shrads and 2 replica. I am using elastic search version 0.90.1 I have a lot of read/writes/deletes. Most of time the lo… --- ## [Read- only access to index](https://discuss.elastic.co/t/read-only-access-to-index/45405)
**Author:** [@dkota](https://discuss.elastic.co/u/dkota)\ **Replies:** 5\ **Last updated:** [March 25, 2016, 5:51pm UTC](https://discuss.elastic.co/t/read-only-access-to-index/45405 "2016-03-25T17:51:26Z")
I want give read-only access to an index for a local user, in kibana. Here is role assigned: bash-4.1$ esusers list esuser : read\_all\_indices roles.yml: Read-only operations on indices read\_all\_indices: i… --- ## [Setting max\_analyzed\_offset permanently for an index](https://discuss.elastic.co/t/setting-max-analyzed-offset-permanently-for-an-index/334470)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [May 29, 2023, 7:48am UTC](https://discuss.elastic.co/t/setting-max-analyzed-offset-permanently-for-an-index/334470 "2023-05-29T07:48:56Z")
Hi All, We are using ELK stack 7.13.2 I came across an error while displaying an index in dashboard as follows: The length \[2134324\] of field \[additionalInfo\] in doc\[100496\]/index\[370844-2023.05.24\] exceeds the \[index… --- ## [Filebeat Error decoding JSON: json: cannot unmarshal string into Go value of type map](https://discuss.elastic.co/t/filebeat-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map/169064)
**Author:** [@analog\_memories](https://discuss.elastic.co/u/analog_memories)\ **Replies:** 5\ **Last updated:** [February 27, 2019, 10:15am UTC](https://discuss.elastic.co/t/filebeat-error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map/169064 "2019-02-27T10:15:50Z")
Hello, I have Filebeat 6.5.0, setup with the following filebeat.yml \> filebeat.inputs: \> - type: log \> enabled: true \> paths: \> - "C:/logs/info/\*registry2json.json" \> scan\_frequency: 10s \> json.keys\_… --- ## [Dec 23rd, 2022: \[pt\_BR\] IoT, coletando dados de um drone em tempo real](https://discuss.elastic.co/t/dec-23rd-2022-pt-br-iot-coletando-dados-de-um-drone-em-tempo-real/318816)
**Author:** [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)\ **Replies:** 3\ **Last updated:** [December 27, 2022, 5:36am UTC](https://discuss.elastic.co/t/dec-23rd-2022-pt-br-iot-coletando-dados-de-um-drone-em-tempo-real/318816 "2022-12-27T05:36:55Z")
Introdução Imagine que o papai Noel esteja sobrevoando Copacabana, a caminho de sua casa para entregar os presentes. Mas você gostaria de saber o momento exato que ele chega para garantir que as crianças estejam dorm… --- ## [ElasticSearch 2 Pipeline Aggregations - Blog post](https://discuss.elastic.co/t/elasticsearch-2-pipeline-aggregations-blog-post/28425)
**Author:** [@tarunsapra](https://discuss.elastic.co/u/tarunsapra)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 1:17am UTC](https://discuss.elastic.co/t/elasticsearch-2-pipeline-aggregations-blog-post/28425 "2015-09-02T01:17:43Z")
Hi All, Just wanted to share with you the following blog post I wrote on the Pipeline Aggregations in ES 2.0 --- ## [Accessing Nested Documents Performance](https://discuss.elastic.co/t/accessing-nested-documents-performance/90366)
**Author:** [@panda2004](https://discuss.elastic.co/u/panda2004)\ **Replies:** 6\ **Last updated:** [June 23, 2017, 3:28pm UTC](https://discuss.elastic.co/t/accessing-nested-documents-performance/90366 "2017-06-23T15:28:21Z")
Hello, It is stated clearly that: Because nested documents are indexed as separate documents, they can only be accessed within the scope of the nested query, the nested/reverse\_nested, or nested inner hits. This fee… --- ## [Disable X-pack features while installing](https://discuss.elastic.co/t/disable-x-pack-features-while-installing/89463)
**Author:** [@josibake](https://discuss.elastic.co/u/josibake)\ **Replies:** 6\ **Last updated:** [June 16, 2017, 12:42am UTC](https://discuss.elastic.co/t/disable-x-pack-features-while-installing/89463 "2017-06-16T00:42:16Z")
Hi, I would like to run Kibana with only security enabled. I am attempting to run Kibana on Heroku and need to keep the startup under 60 seconds. With all the X-Pack features enabled, this is taking too long. I also ca… --- ## [Showing milliseconds as seconds](https://discuss.elastic.co/t/showing-milliseconds-as-seconds/66225)
**Author:** [@Tridy](https://discuss.elastic.co/u/Tridy)\ **Replies:** 2\ **Last updated:** [November 16, 2016, 5:29pm UTC](https://discuss.elastic.co/t/showing-milliseconds-as-seconds/66225 "2016-11-16T17:29:11Z")
Hello. Is there a way to tell to Visualize Metrics, in my case, to show milliseconds in seconds (those are just numbers)? So, is there a way to put /1000 somewhere and round it? Thanks! --- ## [No living connections - Cannot start kibana](https://discuss.elastic.co/t/no-living-connections-cannot-start-kibana/187359)
**Author:** [@lucardo0](https://discuss.elastic.co/u/lucardo0)\ **Replies:** 4\ **Last updated:** [June 25, 2019, 4:26pm UTC](https://discuss.elastic.co/t/no-living-connections-cannot-start-kibana/187359 "2019-06-25T16:26:32Z")
I'm trying to run a docker-compose with kibana and elasticsearch. I tried with 4 different options that i found on the internet, but i keep having the same problem: Kibana server is not ready yet on localhost:5601. Thse… --- ## [Get index by alias with python api](https://discuss.elastic.co/t/get-index-by-alias-with-python-api/137628)
**Author:** [@hrdxwandg](https://discuss.elastic.co/u/hrdxwandg)\ **Replies:** 4\ **Last updated:** [June 29, 2018, 1:18am UTC](https://discuss.elastic.co/t/get-index-by-alias-with-python-api/137628 "2018-06-29T01:18:14Z")
how to get actual index name by index alias name with elasticsearch-py or elasticsearch-dsl-py the version of es is 6.2.4 for your help! thank you ahead! --- ## [How do I use Elastic Agent to send log data to Logstash?](https://discuss.elastic.co/t/how-do-i-use-elastic-agent-to-send-log-data-to-logstash/328269)
**Author:** [@Matt\_Johnston](https://discuss.elastic.co/u/Matt_Johnston)\ **Replies:** 7\ **Last updated:** [March 23, 2023, 12:57pm UTC](https://discuss.elastic.co/t/how-do-i-use-elastic-agent-to-send-log-data-to-logstash/328269 "2023-03-23T12:57:14Z")
Hello. Based on the documentation (Beats and Elastic Agent capabilities | Fleet and Elastic Agent Guide \[8.6\] | Elastic) I am under the impression that the Elastic Agent can send log data to Logstash. However, the only b… --- ## [Is there any right order to reboot the ELK stack?](https://discuss.elastic.co/t/is-there-any-right-order-to-reboot-the-elk-stack/35865)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 3\ **Last updated:** [November 30, 2015, 10:29am UTC](https://discuss.elastic.co/t/is-there-any-right-order-to-reboot-the-elk-stack/35865 "2015-11-30T10:29:35Z")
Hi, I have two servers, i.e. one is for Elasticsearch and Kibana and other is for Logstash. If I want to reboot any of these computers or services, is there any right order? --- ## [Is it possible to display field name and filed value in markdown in kibana4?](https://discuss.elastic.co/t/is-it-possible-to-display-field-name-and-filed-value-in-markdown-in-kibana4/24681)
**Author:** [@Priya\_G](https://discuss.elastic.co/u/Priya_G)\ **Replies:** 8\ **Last updated:** [July 6, 2015, 5:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-display-field-name-and-filed-value-in-markdown-in-kibana4/24681 "2015-07-06T17:16:36Z")
Is it possible to display field name and filed value in markdown in kibana4? I want to display field name and field value in markdown. For Example Filed name is Category Filed values are aaa,bbb,ccc I want to d… --- ## [Failed to parse date format](https://discuss.elastic.co/t/failed-to-parse-date-format/188069)
**Author:** [@Facundo\_Chambo](https://discuss.elastic.co/u/Facundo_Chambo)\ **Replies:** 5\ **Last updated:** [July 4, 2019, 12:26pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-format/188069 "2019-07-04T12:26:32Z")
Hi, I'm having this error when I add a Time Filter in Kibana Canvas. \[essql\] \> Unexpected error from Elasticsearch: \[parse\_exception\] failed to parse date field \[2019-06-27T14:55:01.165Z\] with format \[yyyy-MM-dd HH:mm:… --- ## [Sorting aggregation buckets on string field](https://discuss.elastic.co/t/sorting-aggregation-buckets-on-string-field/1848)
**Author:** [@rikard](https://discuss.elastic.co/u/rikard)\ **Replies:** 6\ **Last updated:** [June 5, 2015, 12:42pm UTC](https://discuss.elastic.co/t/sorting-aggregation-buckets-on-string-field/1848 "2015-06-05T12:42:17Z")
I'm trying to group documents on a field and then sort them on another string field. My aim is to only get one document per group and sort them. For example, let's say the mapping looks like (simplified): { .. "… --- ## [Change column name in saved query](https://discuss.elastic.co/t/change-column-name-in-saved-query/106489)
**Author:** [@yde](https://discuss.elastic.co/u/yde)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 10:45pm UTC](https://discuss.elastic.co/t/change-column-name-in-saved-query/106489 "2017-11-07T22:45:04Z")
Hello, I want to show in my dashboard a saved query (like the picture i pasted in this message). I have created this saved query in "discover" My question, is it possible to change the column name (in yellow) with a l… --- ## [Find length of array in that doc](https://discuss.elastic.co/t/find-length-of-array-in-that-doc/155120)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 3\ **Last updated:** [November 2, 2018, 12:34pm UTC](https://discuss.elastic.co/t/find-length-of-array-in-that-doc/155120 "2018-11-02T12:34:14Z")
I have a field in my index which is an integer array. I want to add another field which contains the count of the number of elements. Even an API call that gives the count is fine. I have found something relevant : "s… --- ## [Kibana how to export csv](https://discuss.elastic.co/t/kibana-how-to-export-csv/249298)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 5:33am UTC](https://discuss.elastic.co/t/kibana-how-to-export-csv/249298 "2020-09-21T05:33:52Z")
i installed kibana and recevied data using logstash i want to export data to csv but share-\> csv reports -\> generate csv button is disabled.. kibana version is 7.9 and license is basic basic license can't using export… --- ## [Handling data in Elasticsearch with Docker](https://discuss.elastic.co/t/handling-data-in-elasticsearch-with-docker/194142)
**Author:** [@jjarthur](https://discuss.elastic.co/u/jjarthur)\ **Replies:** 4\ **Last updated:** [August 8, 2019, 8:06am UTC](https://discuss.elastic.co/t/handling-data-in-elasticsearch-with-docker/194142 "2019-08-08T08:06:43Z")
I'm looking at setting up Elasticsearch within Docker and am trying to figure out the best method for inserting new data. Currently, after running docker-compose up, I run a series of curl commands to set up the index an… --- ## [Windows DNS Diagnostic Logs](https://discuss.elastic.co/t/windows-dns-diagnostic-logs/53344)
**Author:** [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Replies:** 6\ **Last updated:** [June 21, 2016, 5:49pm UTC](https://discuss.elastic.co/t/windows-dns-diagnostic-logs/53344 "2016-06-21T17:49:22Z")
Hello I have enabled DNS Debug Logging on our domain controllers and am using Filebeat to ship these logs, but the problem is the logs do not contain the ip address returned by a DNS query. To get that level of logg… --- ## [Filebeat permission denied docker sock](https://discuss.elastic.co/t/filebeat-permission-denied-docker-sock/116024)
**Author:** [@twan](https://discuss.elastic.co/u/twan)\ **Replies:** 4\ **Last updated:** [January 18, 2018, 1:19pm UTC](https://discuss.elastic.co/t/filebeat-permission-denied-docker-sock/116024 "2018-01-18T13:19:07Z")
Hi all! I've encountered an issue with the filebeat 6.1.2 docker when using the add Docker metadata processor. When I turn this on in the filebeat configuration the following error appears: 2018/01/18 10:42:36.931693 b… --- ## [How to dynamically set script.max\_compilations\_per\_minute?](https://discuss.elastic.co/t/how-to-dynamically-set-script-max-compilations-per-minute/75493)
**Author:** [@patlola](https://discuss.elastic.co/u/patlola)\ **Replies:** 2\ **Last updated:** [February 18, 2017, 3:56am UTC](https://discuss.elastic.co/t/how-to-dynamically-set-script-max-compilations-per-minute/75493 "2017-02-18T03:56:59Z")
I know that we can add this config in elasticsearch.yml but i would like to do it dynamically. documentation says we can change the setting dynamically. https://www.elastic.co/guide/en/elasticsearch/reference/current/m… --- ## [Filebeat on ECK cannot create an index due to user privilage problemes](https://discuss.elastic.co/t/filebeat-on-eck-cannot-create-an-index-due-to-user-privilage-problemes/319364)
**Author:** [@khaled\_belgacem](https://discuss.elastic.co/u/khaled_belgacem)\ **Replies:** 0\ **Last updated:** [November 20, 2022, 11:50am UTC](https://discuss.elastic.co/t/filebeat-on-eck-cannot-create-an-index-due-to-user-privilage-problemes/319364 "2022-11-20T11:50:44Z")
Hello Everyone, On my way discovering ECK I'm running a filebeat instance on my ECK cluster so I can read from a file "ip.txt" and index it to a specific index in elasticsearch named "vpndetect", I keep getting an error… --- ## [How to put the value of {{ctx.payload.aggregations.bucketAgg.buckets.key}} into Watcher body](https://discuss.elastic.co/t/how-to-put-the-value-of-ctx-payload-aggregations-bucketagg-buckets-key-into-watcher-body/193694)
**Author:** [@isabel](https://discuss.elastic.co/u/isabel)\ **Replies:** 5\ **Last updated:** [August 5, 2019, 1:44pm UTC](https://discuss.elastic.co/t/how-to-put-the-value-of-ctx-payload-aggregations-bucketagg-buckets-key-into-watcher-body/193694 "2019-08-05T13:44:25Z")
Hello :slight\_smile: What i am trying to do is to hand over the value of "{{ctx.payload.aggregations.bucketAgg.buckets.key}}" to the body of my Watcher. However, the value is always empty. But in truth it is not! H… --- ## [Message: "failed to find message" in Kibana Logs](https://discuss.elastic.co/t/message-failed-to-find-message-in-kibana-logs/210522)
**Author:** [@jmteba](https://discuss.elastic.co/u/jmteba)\ **Replies:** 2\ **Last updated:** [December 10, 2019, 11:08am UTC](https://discuss.elastic.co/t/message-failed-to-find-message-in-kibana-logs/210522 "2019-12-10T11:08:06Z")
Hello, We have a problem when we try to see logs from Kibana "Logs", so we get this message: "failed to find message", failed\_to\_find\_message|690x424 but in this path there are multiple log's files. failed\_to\_find\_m… --- ## [How to query for empty field or specific value](https://discuss.elastic.co/t/how-to-query-for-empty-field-or-specific-value/119623)
**Author:** [@andresilveira](https://discuss.elastic.co/u/andresilveira)\ **Replies:** 2\ **Last updated:** [February 16, 2018, 10:56am UTC](https://discuss.elastic.co/t/how-to-query-for-empty-field-or-specific-value/119623 "2018-02-16T10:56:36Z")
I'm trying to write a query to achieve the following result: field1: value1 AND field2: value2 OR "" (empty) I've tried the following but it always returns me empty results: { "\_source": \["field1", "field2"\], "q… --- ## [Malformed content, found extra data after parsing: START\_OBJECT](https://discuss.elastic.co/t/malformed-content-found-extra-data-after-parsing-start-object/65376)
**Author:** [@linuxdev](https://discuss.elastic.co/u/linuxdev)\ **Replies:** 2\ **Last updated:** [November 8, 2016, 4:38pm UTC](https://discuss.elastic.co/t/malformed-content-found-extra-data-after-parsing-start-object/65376 "2016-11-08T16:38:35Z")
Im testing elasticsearch and trying to inject a json file. For some reason I get "Malformed content, found extra data after parsing: START\_OBJECT" error. Example query: curl -XPOST 'http://mwdev:9200/test/test/1' … --- ## [Upsert / Update if exist, create if not](https://discuss.elastic.co/t/upsert-update-if-exist-create-if-not/194681)
**Author:** [@ELK-Developer](https://discuss.elastic.co/u/ELK-Developer)\ **Replies:** 2\ **Last updated:** [August 10, 2019, 6:59am UTC](https://discuss.elastic.co/t/upsert-update-if-exist-create-if-not/194681 "2019-08-10T06:59:33Z")
Hello, how do I use upsert, to create or update entries = documents via the output-plugin to elasticsearch, dependent on the document with the given id is already in elasticsearch or even not. My data will come from tw… --- ## [Auto index creation with bulk API](https://discuss.elastic.co/t/auto-index-creation-with-bulk-api/71971)
**Author:** [@kuseman](https://discuss.elastic.co/u/kuseman)\ **Replies:** 7\ **Last updated:** [February 2, 2017, 12:30pm UTC](https://discuss.elastic.co/t/auto-index-creation-with-bulk-api/71971 "2017-02-02T12:30:43Z")
Hi, I have these settings applied (ES version 1.7.5): action.auto\_create\_index: false index.mapper.dynamic: false because I want to have full control over what indices/types are created. But, still I get these in… --- ## [Elasticsearch Docker Container filling up disk](https://discuss.elastic.co/t/elasticsearch-docker-container-filling-up-disk/150904)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 5\ **Last updated:** [October 14, 2018, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-container-filling-up-disk/150904 "2018-10-14T13:07:04Z")
I've been doing some experimentation and development with Elasticsearch and Kibana running in the official docker containers. I've got the ElasticSearch /usr/share/elasticsearch/data mapped to a 1.5TB drive which seems … --- ## [Master node and data node configuration](https://discuss.elastic.co/t/master-node-and-data-node-configuration/132259)
**Author:** [@remo](https://discuss.elastic.co/u/remo)\ **Replies:** 6\ **Last updated:** [May 25, 2018, 1:47pm UTC](https://discuss.elastic.co/t/master-node-and-data-node-configuration/132259 "2018-05-25T13:47:40Z")
I have made changes in elasticsearch.yml for the instance running on my machine and I have set the instance as master node . Similarly I have setup the instances running on other two machines as data nodes. what should b… --- ## [Kibana-MySQL connection](https://discuss.elastic.co/t/kibana-mysql-connection/17949)
**Author:** [@srinu\_konda](https://discuss.elastic.co/u/srinu_konda)\ **Replies:** 1\ **Last updated:** [June 6, 2014, 8:49am UTC](https://discuss.elastic.co/t/kibana-mysql-connection/17949 "2014-06-06T08:49:45Z")
Hi All, I need help on kibana, I need to Connect MySQL Database from Kibana. So please let me know I can achieve it, and me pseudo code if anyone can have it. Thanks & Regards, Srinivas. -- You receiv… --- ## [ECK elasticsearch pod failing to start since it couldn't load persistent cache](https://discuss.elastic.co/t/eck-elasticsearch-pod-failing-to-start-since-it-couldnt-load-persistent-cache/277824)
**Author:** [@Sam\_Mellors](https://discuss.elastic.co/u/Sam_Mellors)\ **Replies:** 8\ **Last updated:** [July 9, 2021, 2:53pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-pod-failing-to-start-since-it-couldnt-load-persistent-cache/277824 "2021-07-09T14:53:02Z")
Hi everyone! I have an ECK operator managed ES cluster of 3 nodes which I am trying to spin up with new persistent volume claims that are using old persistent volumes from a previous ES cluster. In order to do this I d… --- ## [Elasticsearch.yml file is not present after installation](https://discuss.elastic.co/t/elasticsearch-yml-file-is-not-present-after-installation/147825)
**Author:** [@al\_lomax](https://discuss.elastic.co/u/al_lomax)\ **Replies:** 1\ **Last updated:** [September 8, 2018, 5:32pm UTC](https://discuss.elastic.co/t/elasticsearch-yml-file-is-not-present-after-installation/147825 "2018-09-08T17:32:22Z")
I have installed Elasticsearch version 6.4.0 on Windows Server 2016 using the msi installer. Although, the installer ui confirms the default location of the data, config and log folders, after installation, these are no… --- ## [Where can I get the correct kbn-xsrf value for my plugin HTTP requests?](https://discuss.elastic.co/t/where-can-i-get-the-correct-kbn-xsrf-value-for-my-plugin-http-requests/158725)
**Author:** [@trex](https://discuss.elastic.co/u/trex)\ **Replies:** 2\ **Last updated:** [November 29, 2018, 4:11pm UTC](https://discuss.elastic.co/t/where-can-i-get-the-correct-kbn-xsrf-value-for-my-plugin-http-requests/158725 "2018-11-29T16:11:07Z")
I develop a Kibana plugin where I try to use axios HTTP client. Now my code fails with 1. error: "Bad Request" 2. message: "Request must contain a kbn-xsrf header." 3. statusCode: 400 Where can I get the correct kbn-xs… [Previous page](https://discuss.elastic.co/top.md?page=342&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=344&per_page=50&period=all)