# Top **URL:** https://discuss.elastic.co/top.md?page=344&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 345 --- ## [Filebeat creates a "Standalone Cluster" in Kibana Monitoring](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663)
**Author:** [@Christophe\_Journel](https://discuss.elastic.co/u/Christophe_Journel)\ **Replies:** 8\ **Last updated:** [August 6, 2019, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663 "2019-08-06T19:20:41Z")
Hello, I have a whole ELK stack which is perfectly functionnal on production. However, i'm trying (with 7.2.0) to get metrics from filebeat. The problem is: It creates a new "cluster" in Kibana Monitoring page : "Stan… --- ## [Data expiration and ttl](https://discuss.elastic.co/t/data-expiration-and-ttl/38793)
**Author:** [@ycunc](https://discuss.elastic.co/u/ycunc)\ **Replies:** 5\ **Last updated:** [January 10, 2016, 9:02am UTC](https://discuss.elastic.co/t/data-expiration-and-ttl/38793 "2016-01-10T09:02:40Z")
Given a stream of data coming in every second, but we only want to keep data in the past T time (say 1 hour). What is the best way to expire and remove old data? We did some research and found the following two 1) Set … --- ## [Elasticsearch SearchSourceBuilder.size](https://discuss.elastic.co/t/elasticsearch-searchsourcebuilder-size/175601)
**Author:** [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\ **Replies:** 7\ **Last updated:** [April 6, 2019, 5:19pm UTC](https://discuss.elastic.co/t/elasticsearch-searchsourcebuilder-size/175601 "2019-04-06T17:19:25Z")
I am using java High level client API to fetch data, when using searchsourcebuilder by default it takes default 10 documents but i have more than 1,00,000 documents for this i am using searchSourceBuilder.from() and sear… --- ## [How to delete kibana.log](https://discuss.elastic.co/t/how-to-delete-kibana-log/238079)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [June 22, 2020, 12:35pm UTC](https://discuss.elastic.co/t/how-to-delete-kibana-log/238079 "2020-06-22T12:35:36Z")
Hi , my kibana.log is growing rapidly how can I delete it and create a new one , I tried to rename it but it kept growing ... Thanks in advance. --- ## ["message":"socket hang up" in kibana logs](https://discuss.elastic.co/t/message-socket-hang-up-in-kibana-logs/125341)
**Author:** [@vissu](https://discuss.elastic.co/u/vissu)\ **Replies:** 2\ **Last updated:** [March 23, 2018, 3:42pm UTC](https://discuss.elastic.co/t/message-socket-hang-up-in-kibana-logs/125341 "2018-03-23T15:42:17Z")
Hi, i am using elk v6.2.1 i am getting below error in the kibana logs continuously for every second. The error is logged even when there is no use.Does any of you face a similar issue. Here is is my kibana.yml and ela… --- ## [Couldn't find any Elasticsearch data in Kibana](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-in-kibana/149834)
**Author:** [@Kotresh](https://discuss.elastic.co/u/Kotresh)\ **Replies:** 4\ **Last updated:** [September 27, 2018, 5:13am UTC](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-in-kibana/149834 "2018-09-27T05:13:21Z")
Hi, I am trying to implement Elasticsearch for my spring boot application. But some how In Kibana, when i try to configure index, I am not able find any elasticsearch data I made sure that, my elasticsearch, Kibana an… --- ## [\[solved\] Wildcard search with special characters: Differences between ES 1.7 and ES 5.1](https://discuss.elastic.co/t/solved-wildcard-search-with-special-characters-differences-between-es-1-7-and-es-5-1/73720)
**Author:** [@mweibel](https://discuss.elastic.co/u/mweibel)\ **Replies:** 4\ **Last updated:** [February 6, 2017, 7:21am UTC](https://discuss.elastic.co/t/solved-wildcard-search-with-special-characters-differences-between-es-1-7-and-es-5-1/73720 "2017-02-06T07:21:23Z")
I'm in the process of upgrading a project from ES 1.7 to ES 5.1 and noticed an integration test failing. Below is a minimal repro case. When searching using a wildcard search for "brö" I get in both versions the same … --- ## [How can I parse Windows Logs?](https://discuss.elastic.co/t/how-can-i-parse-windows-logs/128519)
**Author:** [@Tempy](https://discuss.elastic.co/u/Tempy)\ **Replies:** 6\ **Last updated:** [May 5, 2018, 7:56pm UTC](https://discuss.elastic.co/t/how-can-i-parse-windows-logs/128519 "2018-05-05T19:56:17Z")
Hello, I am a junior system administrator working mainly with windows, getting used to using Linux. I'm trying to setup the Elastic stack to visualize logs from Windows Services which are part of our production enviro… --- ## [Kibana stuck on "loading" \[RESOLVED\]](https://discuss.elastic.co/t/kibana-stuck-on-loading-resolved/107169)
**Author:** [@RandomDude](https://discuss.elastic.co/u/RandomDude)\ **Replies:** 1\ **Last updated:** [November 10, 2017, 2:28pm UTC](https://discuss.elastic.co/t/kibana-stuck-on-loading-resolved/107169 "2017-11-10T14:28:50Z")
Hello, After a sever crash and restart, when I go on kibana I get get stuck on "loading kibana" with the color changing scheme thing. Here is the output of "journalctl -u kibana.service \>\> log" : Nov 10 12:18:07 XXX s… --- ## [Failed to list shard for shard\_store on node on big environments](https://discuss.elastic.co/t/failed-to-list-shard-for-shard-store-on-node-on-big-environments/179749)
**Author:** [@kley](https://discuss.elastic.co/u/kley)\ **Replies:** 6\ **Last updated:** [May 10, 2019, 10:56am UTC](https://discuss.elastic.co/t/failed-to-list-shard-for-shard-store-on-node-on-big-environments/179749 "2019-05-10T10:56:05Z")
Hi! Before I ask my question, i'll tell you how the environment looks like: We do have a test environment with 6 elasticsearch nodes. Indices are set to two replicas each. Datawise, we have ~5TB of data on each node. … --- ## [Multiple output in Filebeat](https://discuss.elastic.co/t/multiple-output-in-filebeat/283001)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 4:39pm UTC](https://discuss.elastic.co/t/multiple-output-in-filebeat/283001 "2021-09-01T16:39:23Z")
I am trying to setup multiple index outputs from the same filebeat.yml. I have different paths on the same server and I need each path to go to the same logstash but have a different index name. Is it possible? --- ## [Set "fields" into array - SOLVED](https://discuss.elastic.co/t/set-fields-into-array-solved/73995)
**Author:** [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\ **Replies:** 3\ **Last updated:** [February 6, 2017, 11:45am UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995 "2017-02-06T11:45:44Z")
Hello everyone, I'm using the "Twitter input" and I want to put in lowercase one field, I tried some things but I didn't success ... I know that there are few changes since Logstash 5.0 (I'm using Logstash 5.1.1) with … --- ## [Getting 500 error in es5.0.0](https://discuss.elastic.co/t/getting-500-error-in-es5-0-0/65146)
**Author:** [@frankshad](https://discuss.elastic.co/u/frankshad)\ **Replies:** 2\ **Last updated:** [November 7, 2016, 12:27pm UTC](https://discuss.elastic.co/t/getting-500-error-in-es5-0-0/65146 "2016-11-07T12:27:27Z")
string\_index\_out\_of\_bounds\_exception I'm experimenting with moving my app to ES5 (though probably won't do so for real until it is a bit more mature). The first scroll query it does with more than "size" results give… --- ## [Metricbeat kubernetes fails to collect](https://discuss.elastic.co/t/metricbeat-kubernetes-fails-to-collect/217414)
**Author:** [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Replies:** 8\ **Last updated:** [March 10, 2020, 12:08pm UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-fails-to-collect/217414 "2020-03-10T12:08:55Z")
Using the latest elastic helm chart 7.5.2 on EKS kubernetes, I get these errors from metricbeat trying to fetch from kubernetes.volume 2020-01-31T15:32:52.119Z INFO module/wrapper.go:252 Error fetching data for metric… --- ## [Is there a "real" autocomplete anymore in elastic?](https://discuss.elastic.co/t/is-there-a-real-autocomplete-anymore-in-elastic/95531)
**Author:** [@initproto](https://discuss.elastic.co/u/initproto)\ **Replies:** 7\ **Last updated:** [August 2, 2017, 6:28pm UTC](https://discuss.elastic.co/t/is-there-a-real-autocomplete-anymore-in-elastic/95531 "2017-08-02T18:28:21Z")
Hi, For the life of me, I can’t understand why elastic changed the useful and common use-case of finding autocompletion words and abandoned it for entire document results? Who and why was this decision made? It creates … --- ## [Logstash losing connection to Elasticsearch nodes](https://discuss.elastic.co/t/logstash-losing-connection-to-elasticsearch-nodes/145544)
**Author:** [@Nick\_Peirson](https://discuss.elastic.co/u/Nick_Peirson)\ **Replies:** 4\ **Last updated:** [September 18, 2018, 11:22am UTC](https://discuss.elastic.co/t/logstash-losing-connection-to-elasticsearch-nodes/145544 "2018-09-18T11:22:25Z")
We've got two Logstash nodes that read from redis instances and output to an Elasticsearch cluster. The ES cluster has 8 instances. Three instances store the data on their own servers, three master nodes on their own ser… --- ## [Elasticsearch - SQL query](https://discuss.elastic.co/t/elasticsearch-sql-query/77937)
**Author:** [@Larry\_Durden](https://discuss.elastic.co/u/Larry_Durden)\ **Replies:** 6\ **Last updated:** [April 10, 2017, 7:43pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-query/77937 "2017-04-10T19:43:43Z")
The elasticsearch sql demo at Elasticon keynote was pretty interesting. how is it different from existing alternates like https://github.com/NLPchina/elasticsearch-sql Also, it will be great if you could share some links… --- ## ['type': 'illegal\_argument\_exception', 'reason': 'mapper \[sum\] cannot be changed from type \[long\] to \[float\]](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-mapper-sum-cannot-be-changed-from-type-long-to-float/170944)
**Author:** [@revelc33](https://discuss.elastic.co/u/revelc33)\ **Replies:** 3\ **Last updated:** [March 6, 2019, 4:33pm UTC](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-mapper-sum-cannot-be-changed-from-type-long-to-float/170944 "2019-03-06T16:33:08Z")
Hi, i am having problems indexing some documents with python elasticsearch helper (bulk) . I index 504 documents and i get 2 with error like described below! 400, 'error': {'type': 'illegal\_argument\_exception', 'reas… --- ## [Parse fail](https://discuss.elastic.co/t/parse-fail/25173)
**Author:** [@aarongu](https://discuss.elastic.co/u/aarongu)\ **Replies:** 4\ **Last updated:** [July 8, 2015, 6:21pm UTC](https://discuss.elastic.co/t/parse-fail/25173 "2015-07-08T18:21:28Z")
Hey there! I'm currently using elasticsearch with python with flask as my server and I have a basic search set up. When I search random words, search seems to work, but when I search characters such as \[, \] , :, (, ) ,… --- ## [Query where fields from different indexes are not all equal?](https://discuss.elastic.co/t/query-where-fields-from-different-indexes-are-not-all-equal/94174)
**Author:** [@samdash](https://discuss.elastic.co/u/samdash)\ **Replies:** 5\ **Last updated:** [August 4, 2017, 6:24pm UTC](https://discuss.elastic.co/t/query-where-fields-from-different-indexes-are-not-all-equal/94174 "2017-08-04T18:24:00Z")
Hi, Can i query across 2 indexes with just 2 common fields and get other fields in the results ? example : Index 1 has fields : A, B, C, D Index 2 has fields : A,B,E,F,G Only A and B are common between these indexes… --- ## [Kibana unable to retrieve connection](https://discuss.elastic.co/t/kibana-unable-to-retrieve-connection/133001)
**Author:** [@KeninHouston](https://discuss.elastic.co/u/KeninHouston)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 5:49pm UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-connection/133001 "2018-05-23T17:49:13Z")
Hi, I have set up an ElasticSearch cluster which is using x-pack security. I have setup the initial user passwords, elastic and kibana. From the Kibana server, I can connect to the ElasticSearch cluster using the kibana… --- ## [log4j:WARN No appenders could be found for logger (node)](https://discuss.elastic.co/t/log4j-warn-no-appenders-could-be-found-for-logger-node/11907)
**Author:** [@the\_nozzle](https://discuss.elastic.co/u/the_nozzle)\ **Replies:** 8\ **Last updated:** [May 11, 2013, 12:12am UTC](https://discuss.elastic.co/t/log4j-warn-no-appenders-could-be-found-for-logger-node/11907 "2013-05-11T00:12:43Z")
Hey everyone Started to get that warning after upgrading to 0.9. Tried the usual configuration options to no avail (config pasted below). Any help would be appreciated.. To make sure that the paths are set I un… --- ## [Relation between "\_version", "\_seq\_no" and "\_primary\_term"](https://discuss.elastic.co/t/relation-between-version-seq-no-and-primary-term/179647)
**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\ **Replies:** 5\ **Last updated:** [May 5, 2019, 9:03am UTC](https://discuss.elastic.co/t/relation-between-version-seq-no-and-primary-term/179647 "2019-05-05T09:03:52Z")
Does "\_version" of a document will always map to a unique combination of "\_seq\_no" and "\_primary\_term"? Or multiple "\_version" of the doc can have same combination of "\_seq\_no" and "\_primary\_term"? Context: From ES 7, … --- ## [Exiting: error loading config file: stat filebeat.yml: no such file or directory](https://discuss.elastic.co/t/exiting-error-loading-config-file-stat-filebeat-yml-no-such-file-or-directory/205154)
**Author:** [@thurston](https://discuss.elastic.co/u/thurston)\ **Replies:** 2\ **Last updated:** [October 25, 2019, 12:58pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-stat-filebeat-yml-no-such-file-or-directory/205154 "2019-10-25T12:58:59Z")
Hello, I compiled filebeat from source to run on arm architecture. I successfully have filebeat running, but I have noticed that I can't just run filebeat command. ex. filebeat setup -e Contrary to normal filebeat ins… --- ## [Amount/Money mapping in Elasticsearch](https://discuss.elastic.co/t/amount-money-mapping-in-elasticsearch/8857)
**Author:** [@Michael\_Kleen](https://discuss.elastic.co/u/Michael_Kleen)\ **Replies:** 3\ **Last updated:** [October 4, 2012, 8:41pm UTC](https://discuss.elastic.co/t/amount-money-mapping-in-elasticsearch/8857 "2012-10-04T20:41:08Z")
Hello, I am currently looking into the possibilities of mapping monetary types in elasticsearch. Unfortunately I couldnt find a designated module for it similar to http://wiki.apache.org/solr/CurrencyField. Wha… --- ## [Logging in JSON format using custom log4j Patter Layout](https://discuss.elastic.co/t/logging-in-json-format-using-custom-log4j-patter-layout/28622)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 1\ **Last updated:** [September 3, 2015, 6:05pm UTC](https://discuss.elastic.co/t/logging-in-json-format-using-custom-log4j-patter-layout/28622 "2015-09-03T18:05:43Z")
Hi All, I was using the ELK stack for some time and integrated with most of application servers which are developed in java. We are using log4j framework for logging and initially configured the log stash agent with in… --- ## [Elastic search how to ignore a field in mapping](https://discuss.elastic.co/t/elastic-search-how-to-ignore-a-field-in-mapping/29145)
**Author:** [@apt275](https://discuss.elastic.co/u/apt275)\ **Replies:** 3\ **Last updated:** [September 14, 2015, 5:48pm UTC](https://discuss.elastic.co/t/elastic-search-how-to-ignore-a-field-in-mapping/29145 "2015-09-14T17:48:34Z")
i am trying to create a mapping in elastic search to ignore one of the fields in my incoming data. i am following the documentation here https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-object-ty… --- ## [Enable x-pack on a Docker-Compose elasticsearch cluster](https://discuss.elastic.co/t/enable-x-pack-on-a-docker-compose-elasticsearch-cluster/214102)
**Author:** [@decal](https://discuss.elastic.co/u/decal)\ **Replies:** 3\ **Last updated:** [January 7, 2020, 5:42pm UTC](https://discuss.elastic.co/t/enable-x-pack-on-a-docker-compose-elasticsearch-cluster/214102 "2020-01-07T17:42:30Z")
Hi, I have a 3 node cluster in docker, and I want to use xpack security, this is my actual environment config inside the docker compose, but im not able to enable xpack security environment: - node.name=es01 - clust… --- ## [Got 403 Forbidden with chrome user-agent](https://discuss.elastic.co/t/got-403-forbidden-with-chrome-user-agent/52812)
**Author:** [@lellansin](https://discuss.elastic.co/u/lellansin)\ **Replies:** 8\ **Last updated:** [June 15, 2016, 8:27am UTC](https://discuss.elastic.co/t/got-403-forbidden-with-chrome-user-agent/52812 "2016-06-15T08:27:17Z")
Elasticsearch version: 2.3.1 JVM version: java -version openjdk version "1.8.0\_71" OpenJDK Runtime Environment (build 1.8.0\_71-b15) OpenJDK 64-Bit Server VM (build 25.71-b15, mixed mode) OS version: lsb\_r… --- ## [What are "number\_of\_routing\_shards"?](https://discuss.elastic.co/t/what-are-number-of-routing-shards/120506)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 3\ **Last updated:** [February 20, 2018, 7:31pm UTC](https://discuss.elastic.co/t/what-are-number-of-routing-shards/120506 "2018-02-20T19:31:34Z")
Hi, I've looked online for answers to this but can't find anything that tells me definitively. I'm looking for an explanation of what "number\_of\_routing\_shards": 30 means. I'm reducing the default template to 1 shard … --- ## [Getting error when i try to import the Json file](https://discuss.elastic.co/t/getting-error-when-i-try-to-import-the-json-file/67676)
**Author:** [@raki1205](https://discuss.elastic.co/u/raki1205)\ **Replies:** 6\ **Last updated:** [December 2, 2016, 6:31pm UTC](https://discuss.elastic.co/t/getting-error-when-i-try-to-import-the-json-file/67676 "2016-12-02T18:31:06Z")
Hi, I'm new to elastic search. When i try to load a json file using CURl, I'm getting an error ERROR $ curl -XPUT xxxxxxxxxx:9200/\_bulk --data-binary @FSAudit.log-2016-11-30-001.part.json {"error":{"root\_cause":\[{"typ… --- ## [Two if conditions in one line](https://discuss.elastic.co/t/two-if-conditions-in-one-line/91314)
**Author:** [@pmadhavan1](https://discuss.elastic.co/u/pmadhavan1)\ **Replies:** 2\ **Last updated:** [June 29, 2017, 6:30pm UTC](https://discuss.elastic.co/t/two-if-conditions-in-one-line/91314 "2017-06-29T18:30:19Z")
Hi, I want to add an if condition for two timestamps. I want to say that if either of them don't match then the message should be dropped. if !\[log\_timestamp\] { # drop {} # } # if !(\[log\_timestamp2\]… --- ## [How to remove unwanted tags from logstash](https://discuss.elastic.co/t/how-to-remove-unwanted-tags-from-logstash/90760)
**Author:** [@cazyfunlover](https://discuss.elastic.co/u/cazyfunlover)\ **Replies:** 3\ **Last updated:** [June 26, 2017, 9:30pm UTC](https://discuss.elastic.co/t/how-to-remove-unwanted-tags-from-logstash/90760 "2017-06-26T21:30:04Z")
Hi i wanted to remove duplicate tags like ("@version" ,"beat","hostname","name" ) , how can i do that ? { "msg" =\> "Beginning Product data refresh", "timestamp\_match" =\> "2017-06-25 12:1… --- ## [Cross Cluster Replication - Active/Active?](https://discuss.elastic.co/t/cross-cluster-replication-active-active/128198)
**Author:** [@HBSequence](https://discuss.elastic.co/u/HBSequence)\ **Replies:** 7\ **Last updated:** [March 30, 2019, 12:49pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-active-active/128198 "2019-03-30T12:49:24Z")
Hello. We need to create two Elasticsearch clusters, with each cluster in a different date centre. The data in the clusters will be accessed by users in an active/active manner, with traffic being balanced across the dat… --- ## [About auto create index](https://discuss.elastic.co/t/about-auto-create-index/122675)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 2:05pm UTC](https://discuss.elastic.co/t/about-auto-create-index/122675 "2018-03-06T14:05:36Z")
what should I do? elasticsearch.yml add content :slight\_smile: action.auto.create.index: .security,.watcher, .watcher-histroy\* ,why kibana display below info Oh no! It looks like your Elasticsearch cluster's action.… --- ## [Collecting Java logs from a dockerised application?](https://discuss.elastic.co/t/collecting-java-logs-from-a-dockerised-application/127783)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 7\ **Last updated:** [April 16, 2018, 2:51pm UTC](https://discuss.elastic.co/t/collecting-java-logs-from-a-dockerised-application/127783 "2018-04-16T14:51:12Z")
I currently have a Java application which generates a set of Log4j2 log files (RollingFile appender) which is harvested by Filebeat (and sent on to Logstash and ES in the usual way). This all works fine. But now there i… --- ## [Rabbitmq as logstash input](https://discuss.elastic.co/t/rabbitmq-as-logstash-input/95756)
**Author:** [@Daniel\_Dziubecki](https://discuss.elastic.co/u/Daniel_Dziubecki)\ **Replies:** 4\ **Last updated:** [August 3, 2017, 7:00pm UTC](https://discuss.elastic.co/t/rabbitmq-as-logstash-input/95756 "2017-08-03T19:00:23Z")
Im trying to read logs from rabbitmq queue from logstash and then pass it to elasticsearch. But with no success. Here is my logstash config. input { rabbitmq { host =\> "localhost" port =\> 15672 … --- ## [Docker Filebeat can't connect to Docker ELK's http://logstash:5044 but can connect to http://logstash:9600](https://discuss.elastic.co/t/docker-filebeat-cant-connect-to-docker-elks-http-logstash-5044-but-can-connect-to-http-logstash-9600/146556)
**Author:** [@shirakaba](https://discuss.elastic.co/u/shirakaba)\ **Replies:** 5\ **Last updated:** [August 29, 2018, 7:30pm UTC](https://discuss.elastic.co/t/docker-filebeat-cant-connect-to-docker-elks-http-logstash-5044-but-can-connect-to-http-logstash-9600/146556 "2018-08-29T19:30:45Z")
This is a continuation of my thread from yesterday: Docker Filebeat can’t connect to Docker bridge network despite ELK being able to. Now I'm trying to send logs from Filebeat to Logstash, rather than directly to Elasti… --- ## [Grok filter is not working using Filebeat](https://discuss.elastic.co/t/grok-filter-is-not-working-using-filebeat/122929)
**Author:** [@SarojELK](https://discuss.elastic.co/u/SarojELK)\ **Replies:** 6\ **Last updated:** [March 8, 2018, 7:24am UTC](https://discuss.elastic.co/t/grok-filter-is-not-working-using-filebeat/122929 "2018-03-08T07:24:36Z")
Hi experts. I already setup ELK stack and it working normally. But I am having a tough time in setting up log shipping using Filebeat and adding custom fields (grok filter) via logstash. my sample log lines \[3/2/16 2:… --- ## [Configuring Logstash to Use Dead Letter Queues](https://discuss.elastic.co/t/configuring-logstash-to-use-dead-letter-queues/120892)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 8\ **Last updated:** [February 22, 2018, 4:00am UTC](https://discuss.elastic.co/t/configuring-logstash-to-use-dead-letter-queues/120892 "2018-02-22T04:00:09Z")
Per Configuring Logstash to Use Dead Letter Queues: Dead letter queues are disabled by default. To enable dead letter queues, set the dead\_letter\_queue\_enable option in the logstash.yml settings file: dead\_letter\_queu… --- ## [Kibanaで9時間ずれて表示される現象について](https://discuss.elastic.co/t/kibana-9/158683)
**Author:** [@hmlhmz](https://discuss.elastic.co/u/hmlhmz)\ **Replies:** 2\ **Last updated:** [December 23, 2018, 4:40am UTC](https://discuss.elastic.co/t/kibana-9/158683 "2018-12-23T04:40:03Z")
json形式のデータをelasticsearchへ登録し、kibanaで確認すると9時間時刻がずれます。(登録したデータより+9時間) 回避・修正方法を教えて下さい。 ■環境 ・Windows Server 2016 ・kibana 6.4.2 ・elasticsearch 6.4.2 --- ## [ECK Elasticsearch - Performing Full Restart of ES Nodes](https://discuss.elastic.co/t/eck-elasticsearch-performing-full-restart-of-es-nodes/312798)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 8\ **Last updated:** [September 22, 2022, 1:25pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-performing-full-restart-of-es-nodes/312798 "2022-09-22T13:25:08Z")
Hello hello, I would like to ask you whether is possible to perform full restart of ES nodes using ECK operator. Is it possible to do using this? updateStrategy: changeBudget: maxSurge: \ … --- ## [Counting string occurrences in string](https://discuss.elastic.co/t/counting-string-occurrences-in-string/135597)
**Author:** [@gregpaskal](https://discuss.elastic.co/u/gregpaskal)\ **Replies:** 6\ **Last updated:** [June 14, 2018, 7:32pm UTC](https://discuss.elastic.co/t/counting-string-occurrences-in-string/135597 "2018-06-14T19:32:30Z")
I'm looking for a way to count the number of string occurrences within a string. Say for instance I have the following string "Hello World" and I wanted to return the number of "l" found within this string. How would I … --- ## [Typically this happens if the network/Elasticsearch cluster is not accessible or when targeting a WAN/Cloud instance without the proper setting 'es.nodes.wan.only'](https://discuss.elastic.co/t/typically-this-happens-if-the-network-elasticsearch-cluster-is-not-accessible-or-when-targeting-a-wan-cloud-instance-without-the-proper-setting-es-nodes-wan-only/136655)
**Author:** [@Sricharan\_Gadde](https://discuss.elastic.co/u/Sricharan_Gadde)\ **Replies:** 4\ **Last updated:** [June 25, 2018, 3:27pm UTC](https://discuss.elastic.co/t/typically-this-happens-if-the-network-elasticsearch-cluster-is-not-accessible-or-when-targeting-a-wan-cloud-instance-without-the-proper-setting-es-nodes-wan-only/136655 "2018-06-25T15:27:24Z")
I hosted ElasticSearch on Azure and connecting to the Hive to load data into elastic search. I am doing steps as follows add jar adl://stepoc.azuredatalakestore.net/ES-Hadoop-Jars/elasticsearch-hadoop-6.3.0.jar; add j… --- ## [Path.repo not found](https://discuss.elastic.co/t/path-repo-not-found/25035)
**Author:** [@tanveer3](https://discuss.elastic.co/u/tanveer3)\ **Replies:** 7\ **Last updated:** [July 7, 2015, 3:06pm UTC](https://discuss.elastic.co/t/path-repo-not-found/25035 "2015-07-07T15:06:35Z")
Hi All I am getting the below error while creating repository on windows CMD ....... POST /\_snapshot/backup1 { "type": "fs", "settings": { "location": "c:\\es\_backup\_folder", "compress": "true" } } Ent… --- ## [Uncaught TypeError: window.ga is not a function](https://discuss.elastic.co/t/uncaught-typeerror-window-ga-is-not-a-function/181066)
**Author:** [@highered](https://discuss.elastic.co/u/highered)\ **Replies:** 8\ **Last updated:** [May 15, 2019, 2:36pm UTC](https://discuss.elastic.co/t/uncaught-typeerror-window-ga-is-not-a-function/181066 "2019-05-15T14:36:19Z")
We're trying to implement Site Search with a custom search field. However, if a user types something in the field and then hits "return", this error appears in the console: st.js:73 Uncaught TypeError: window.ga is not … --- ## [Logstash with docker: unknown setting 'protocol', 'host' for elasticsearch](https://discuss.elastic.co/t/logstash-with-docker-unknown-setting-protocol-host-for-elasticsearch/32815)
**Author:** [@elastiguy](https://discuss.elastic.co/u/elastiguy)\ **Replies:** 4\ **Last updated:** [October 23, 2015, 4:04pm UTC](https://discuss.elastic.co/t/logstash-with-docker-unknown-setting-protocol-host-for-elasticsearch/32815 "2015-10-23T16:04:50Z")
Hello, I have a strange problem when using the official logstash image version 2.0. I am testing a basic logstash to ES configuration using the example from the documentation. I run Logstash via docker and everythin… --- ## [Json::ParserError: Unrecognized token](https://discuss.elastic.co/t/json-unrecognized-token/215006)
**Author:** [@akuninja](https://discuss.elastic.co/u/akuninja)\ **Replies:** 6\ **Last updated:** [January 15, 2020, 2:37pm UTC](https://discuss.elastic.co/t/json-unrecognized-token/215006 "2020-01-15T14:37:18Z")
//////////////////////////////////THIS PART I SOLVED MYSELF /////////////////////////////////////// I am still getting a broken token within my logstash output, and I do not know where this timestamp (possibly) token co… --- ## [Kibana behind apache reverse proxy with different paths?](https://discuss.elastic.co/t/kibana-behind-apache-reverse-proxy-with-different-paths/178584)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [April 29, 2019, 2:28pm UTC](https://discuss.elastic.co/t/kibana-behind-apache-reverse-proxy-with-different-paths/178584 "2019-04-29T14:28:10Z")
Hi, I am struggling a while for now, so hopefully you can open my eyes and point me into the right direction. I am running multiple kibana instances (for different clusters) in docker and also I am running a single htt… --- ## [Default values for missing fields](https://discuss.elastic.co/t/default-values-for-missing-fields/303333)
**Author:** [@tfinan](https://discuss.elastic.co/u/tfinan)\ **Replies:** 6\ **Last updated:** [April 27, 2022, 1:47pm UTC](https://discuss.elastic.co/t/default-values-for-missing-fields/303333 "2022-04-27T13:47:00Z")
Can I create a field in a mapping that will be indexed with some default value if that field is not present in the document being indexed? In other words, if I have a mapping with the field {"Rating": "integer"}, and th… [Previous page](https://discuss.elastic.co/top.md?page=343&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=345&per_page=50&period=all)