# Top **URL:** https://discuss.elastic.co/top.md?page=370&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 371 --- ## [/var/lib/elasticsearch/tmp not accessible in ES 6.8](https://discuss.elastic.co/t/var-lib-elasticsearch-tmp-not-accessible-in-es-6-8/252723)
**Author:** [@Chris\_Gatihi](https://discuss.elastic.co/u/Chris_Gatihi)\ **Replies:** 2\ **Last updated:** [October 21, 2020, 5:41pm UTC](https://discuss.elastic.co/t/var-lib-elasticsearch-tmp-not-accessible-in-es-6-8/252723 "2020-10-21T17:41:01Z")
Hi, I'm doing an upgrade from ES 5.6 to ES 6.8. When starting ES 6.8, I'm getting this exception: -- Logs begin at Tue 2020-10-20 00:29:07 UTC, end at Tue 2020-10-20 17:35:18 UTC. -- Oct 20 00:29:56 systemd\[1… --- ## [How to run queries from multiple JDBC inputs sequentially](https://discuss.elastic.co/t/how-to-run-queries-from-multiple-jdbc-inputs-sequentially/77226)
**Author:** [@madebydna](https://discuss.elastic.co/u/madebydna)\ **Replies:** 3\ **Last updated:** [March 21, 2017, 8:18pm UTC](https://discuss.elastic.co/t/how-to-run-queries-from-multiple-jdbc-inputs-sequentially/77226 "2017-03-21T20:18:35Z")
My pipeline consists of three JDBC inputs, a set of common filters and one output stage to Elasticsearch. The three JDBC inputs fetch similar data from three different tables, the aggregate filter groups the data by a pa… --- ## [Adding new fields from a match \[solved\]](https://discuss.elastic.co/t/adding-new-fields-from-a-match-solved/176197)
**Author:** [@elasticSmash](https://discuss.elastic.co/u/elasticSmash)\ **Replies:** 6\ **Last updated:** [April 12, 2019, 9:53am UTC](https://discuss.elastic.co/t/adding-new-fields-from-a-match-solved/176197 "2019-04-12T09:53:34Z")
Hi. New to logstash. One thing I don't understand is that when a you match a line with something like %{GREEDYDATA:myfield1}, does that automatically create a corresponding field in elasticsearch or do I need to add it o… --- ## [How to safely apply new configuration from elasticsearch.yml](https://discuss.elastic.co/t/how-to-safely-apply-new-configuration-from-elasticsearch-yml/18878)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [July 24, 2014, 10:39pm UTC](https://discuss.elastic.co/t/how-to-safely-apply-new-configuration-from-elasticsearch-yml/18878 "2014-07-24T22:39:08Z")
I manage my ES cluster using Ansible. Specifically I wrote this role https://github.com/LaneCommunityCollege/aspects\_elasticsearch to do most of the work for me. The issue right now is that if I make a change to … --- ## [Insert new line to email body on an alert](https://discuss.elastic.co/t/insert-new-line-to-email-body-on-an-alert/50577)
**Author:** [@atam](https://discuss.elastic.co/u/atam)\ **Replies:** 2\ **Last updated:** [May 20, 2016, 9:42pm UTC](https://discuss.elastic.co/t/insert-new-line-to-email-body-on-an-alert/50577 "2016-05-20T21:42:18Z")
Is there a way to insert a new line ("\\n") or multiple lines in the email "body" element? --- ## [Index template not applying to indices](https://discuss.elastic.co/t/index-template-not-applying-to-indices/158244)
**Author:** [@alastairs](https://discuss.elastic.co/u/alastairs)\ **Replies:** 6\ **Last updated:** [November 28, 2018, 8:50am UTC](https://discuss.elastic.co/t/index-template-not-applying-to-indices/158244 "2018-11-28T08:50:20Z")
Hi there We're using Filebeat 6.4.2 to scrape our logs from Kubernetes (with Docker) and are shipping our logs directly to Elastic Cloud, running 6.5.0. I loaded a custom index template into Elasticsearch to add a .raw … --- ## [Not able to start the elasticsearch service](https://discuss.elastic.co/t/not-able-to-start-the-elasticsearch-service/252722)
**Author:** [@narayask](https://discuss.elastic.co/u/narayask)\ **Replies:** 4\ **Last updated:** [November 2, 2020, 4:08am UTC](https://discuss.elastic.co/t/not-able-to-start-the-elasticsearch-service/252722 "2020-11-02T04:08:14Z")
Hi Team, Getting below error while starting the elastic service for version elasticsearch-7.8.1-amd64.deb elasticsearch-7.7.0-amd64.deb on ubuntu system and getting below error. Please do the needful. \[2020-10-20T1… --- ## [Ingest pipeline not working but working in the simulate API](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322)
**Author:** [@themarcusaurelius](https://discuss.elastic.co/u/themarcusaurelius)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 3:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-but-working-in-the-simulate-api/205322 "2020-12-01T15:42:41Z")
I have a pipeline that is filtering Palo Alto logs through Grok patterns and other processors. Testing with the simulate API shows that it works but when I try to ingest into elasticsearch none of the documents go throug… --- ## [NGINX reverse proxy, to local KIBANA, to AWS ElasticSearch](https://discuss.elastic.co/t/nginx-reverse-proxy-to-local-kibana-to-aws-elasticsearch/70457)
**Author:** [@Neil\_Briscoe](https://discuss.elastic.co/u/Neil_Briscoe)\ **Replies:** 3\ **Last updated:** [January 3, 2017, 6:33pm UTC](https://discuss.elastic.co/t/nginx-reverse-proxy-to-local-kibana-to-aws-elasticsearch/70457 "2017-01-03T18:33:37Z")
Newbie here. I have managed to get NGINX reverse proxy, connecting to Kibana, connecting to ES when all on the same box in AWS. Doing this to add simple authentication. I am now wanting to utilise the AWS ES service … --- ## [Elasticsearch 7.13.3 and 6.8.17 Security Update](https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100 "2021-07-07T17:23:56Z")
Elasticsearch Denial of Service issue (ESA-2021-15) An uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submi… --- ## [Vote to support ES on metabase](https://discuss.elastic.co/t/vote-to-support-es-on-metabase/32747)
**Author:** [@yehosef](https://discuss.elastic.co/u/yehosef)\ **Replies:** 1\ **Last updated:** [February 27, 2016, 8:44pm UTC](https://discuss.elastic.co/t/vote-to-support-es-on-metabase/32747 "2016-02-27T20:44:13Z")
http://metabase.com is an new opensource BI tool that looks like it would have a lot of promise. Please vote at https://github.com/metabase/metabase/issues/1300 for ES support --- ## [Case insensitive search by using query in java API](https://discuss.elastic.co/t/case-insensitive-search-by-using-query-in-java-api/61515)
**Author:** [@prasad\_kp](https://discuss.elastic.co/u/prasad_kp)\ **Replies:** 6\ **Last updated:** [September 27, 2016, 6:54am UTC](https://discuss.elastic.co/t/case-insensitive-search-by-using-query-in-java-api/61515 "2016-09-27T06:54:04Z")
Hi Team, I have 10 indices and each index type contains on an average of 7 string fields, Now i want to do case insensitive search on this fields of all index,i tried this setting & mapping "analyzer": { … --- ## [Elasticsearch master slave configuration](https://discuss.elastic.co/t/elasticsearch-master-slave-configuration/147525)
**Author:** [@kobesado](https://discuss.elastic.co/u/kobesado)\ **Replies:** 1\ **Last updated:** [September 6, 2018, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-master-slave-configuration/147525 "2018-09-06T08:34:10Z")
Hi, I'm trying to configuration a cluster with 1 Master node , 2 slave nodes. After restarting the service, master elascticseach.bat is okey but slave elascticseach.bat been getting the following error: \[node\_154\] not… --- ## [Unable to navigate to space "default", redirecting to Space Selector. Error: Saved object \[space/default\] not found](https://discuss.elastic.co/t/unable-to-navigate-to-space-default-redirecting-to-space-selector-error-saved-object-space-default-not-found/177393)
**Author:** [@jrplus](https://discuss.elastic.co/u/jrplus)\ **Replies:** 3\ **Last updated:** [April 18, 2019, 8:21pm UTC](https://discuss.elastic.co/t/unable-to-navigate-to-space-default-redirecting-to-space-selector-error-saved-object-space-default-not-found/177393 "2019-04-18T20:21:30Z")
How do i manually create a space? It seems that the default:space has been deleted. Restarting Kibana doesn't help in automatically creating it either. --- ## [Search By Document Length](https://discuss.elastic.co/t/search-by-document-length/64013)
**Author:** [@krmathieu](https://discuss.elastic.co/u/krmathieu)\ **Replies:** 6\ **Last updated:** [October 28, 2016, 3:37pm UTC](https://discuss.elastic.co/t/search-by-document-length/64013 "2016-10-28T15:37:51Z")
I have a field called document.content that contains the overall text of the document that I am indexing and I want to return only those records where document.content is greater than a certain length. How would I go abo… --- ## [Different results because of replicas](https://discuss.elastic.co/t/different-results-because-of-replicas/201256)
**Author:** [@Ewoks](https://discuss.elastic.co/u/Ewoks)\ **Replies:** 7\ **Last updated:** [September 27, 2019, 8:31am UTC](https://discuss.elastic.co/t/different-results-because-of-replicas/201256 "2019-09-27T08:31:32Z")
Hello, my Elasticsearch 6.x Index has 1 shard and 2 replicas with ~20k documents. When I make 2 consecutive requests with exactly same parameters, I get same number of hits with slightly differently scored results, i.e… --- ## [Could not locate that dashboard (5.4)](https://discuss.elastic.co/t/could-not-locate-that-dashboard-5-4/90817)
**Author:** [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\ **Replies:** 4\ **Last updated:** [June 27, 2017, 7:00pm UTC](https://discuss.elastic.co/t/could-not-locate-that-dashboard-5-4/90817 "2017-06-27T19:00:33Z")
Tried to create a simple dashboard with navigation but am constantly receiving a "Could not locate that dashboard(id: Omzet\_totaal). { "title": "Customer", "type": "markdown", "params": { "markdown": "- Omzet… --- ## [Filebeat is not starting](https://discuss.elastic.co/t/filebeat-is-not-starting/57832)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 5\ **Last updated:** [August 11, 2016, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-is-not-starting/57832 "2016-08-11T23:48:47Z")
I am new to ELK stack and trying make it work. First I tried to configure filebeat to display syslog on Kibana and able to get through but when I tried to get DOCS logs, Filebeat failed to start. Following is snippet … --- ## [Elastic 5.4.0 TransportClient does not work](https://discuss.elastic.co/t/elastic-5-4-0-transportclient-does-not-work/85957)
**Author:** [@billnbell](https://discuss.elastic.co/u/billnbell)\ **Replies:** 6\ **Last updated:** [June 20, 2017, 5:14pm UTC](https://discuss.elastic.co/t/elastic-5-4-0-transportclient-does-not-work/85957 "2017-06-20T17:14:13Z")
I cannot open a connection using the Elastic Search Transport Client to 5.4.0. It works if I use the 5.3.2 client. I also ran out of open file handles. Maybe becuase I kept retrying the connection? I am giving it sni… --- ## [How to make a query for group by count?](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 2\ **Last updated:** [July 17, 2019, 9:39am UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776 "2019-07-17T09:39:35Z")
Hello! I looking for information by event\_id 2771 And i get result table (example): I want to group the data and hide the duplicate TargetUser by their count in table. I want this result: Is it possible? How to … --- ## [Searching on keywords that have spaces fail using simple\_query\_string](https://discuss.elastic.co/t/searching-on-keywords-that-have-spaces-fail-using-simple-query-string/298577)
**Author:** [@JJK](https://discuss.elastic.co/u/JJK)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 7:30pm UTC](https://discuss.elastic.co/t/searching-on-keywords-that-have-spaces-fail-using-simple-query-string/298577 "2022-03-15T19:30:08Z")
I have a tags keyword field defined simply as: 'tags' =\> \[ 'type' =\> 'keyword' \], I have a tag field that stores: "tags" : \[ "523", "523 az" \], I have a simple search set… --- ## [Pipeline aborted due to error](https://discuss.elastic.co/t/pipeline-aborted-due-to-error/62599)
**Author:** [@bopa](https://discuss.elastic.co/u/bopa)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 7:48am UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error/62599 "2016-10-10T07:48:26Z")
My logstash service status change into "Active (Exited)" after few seconds of starting the service. I got a logstash error as follows in the logstash.log {:timestamp=\>"2016-10-10T11:11:04.510000+0530", :message=\>"stopp… --- ## [Error in BULK](https://discuss.elastic.co/t/error-in-bulk/73580)
**Author:** [@manandappa](https://discuss.elastic.co/u/manandappa)\ **Replies:** 1\ **Last updated:** [February 2, 2017, 2:11am UTC](https://discuss.elastic.co/t/error-in-bulk/73580 "2017-02-02T02:11:56Z")
I am trying to do a POST -bulk and am getting an error { "error": { "root\_cause": \[ { "type": "json\_e\_o\_f\_exception", "reason": "Unexpected end-of-input: expected close marker for Object (sta… --- ## [ES query to find the earliest occurrence of message for each host](https://discuss.elastic.co/t/es-query-to-find-the-earliest-occurrence-of-message-for-each-host/25972)
**Author:** [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\ **Replies:** 3\ **Last updated:** [July 24, 2015, 11:28am UTC](https://discuss.elastic.co/t/es-query-to-find-the-earliest-occurrence-of-message-for-each-host/25972 "2015-07-24T11:28:21Z")
I am experienced with ELK but not so much with directly querying Elasticsearch and I need help to construct an Elasticsearch query. We are currently using Elasticsearch 1.4.4 and not using Watcher. The data contains err… --- ## [Many types in single index vs multiple indices](https://discuss.elastic.co/t/many-types-in-single-index-vs-multiple-indices/17695)
**Author:** [@Erdinc\_Yilmazel](https://discuss.elastic.co/u/Erdinc_Yilmazel)\ **Replies:** 0\ **Last updated:** [May 23, 2014, 12:51pm UTC](https://discuss.elastic.co/t/many-types-in-single-index-vs-multiple-indices/17695 "2014-05-23T12:51:16Z")
Hi all, I tend to think that having so many different type of documents within a single index would not be the most optimal solution especially if these types don't have a lot of overlapping fields. Would creating… --- ## ["\_geoip\_lookup\_failure" own src/dst ip mapping don't work](https://discuss.elastic.co/t/geoip-lookup-failure-own-src-dst-ip-mapping-dont-work/125496)
**Author:** [@jiona](https://discuss.elastic.co/u/jiona)\ **Replies:** 5\ **Last updated:** [March 26, 2018, 9:41pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-own-src-dst-ip-mapping-dont-work/125496 "2018-03-26T21:41:03Z")
Hi all. Can someone help me to findout why I get a "\_geoip\_lookup\_failure". I have separate elasticsearch and logstash servers. On elasticsearch I have install the plugin "ingest-geoip" $ sudo bin/elasticsearch-plugi… --- ## [Invalid version of beats protocol?](https://discuss.elastic.co/t/invalid-version-of-beats-protocol/205259)
**Author:** [@kavindu\_manaram](https://discuss.elastic.co/u/kavindu_manaram)\ **Replies:** 1\ **Last updated:** [October 25, 2019, 5:03pm UTC](https://discuss.elastic.co/t/invalid-version-of-beats-protocol/205259 "2019-10-25T17:03:35Z")
I try to used filebeat and logstash in local machine with cloud Elasticsearch. And some errors comes on filebeat and logstash both. \[2019-10-25T20:16:46,162\]\[INFO \]\[org.logstash.beats.BeatsHandler\]\[main\] \[local: 172.16… --- ## [No-SQL injection](https://discuss.elastic.co/t/no-sql-injection/79403)
**Author:** [@Kartik\_Malik](https://discuss.elastic.co/u/Kartik_Malik)\ **Replies:** 3\ **Last updated:** [March 27, 2017, 6:09am UTC](https://discuss.elastic.co/t/no-sql-injection/79403 "2017-03-27T06:09:34Z")
Hi, I am very new to elastic search so my question might sound stupid . I am working on a project that uses elasticsearch as the database. I have a search page on our app, when user enters some keyword in the search bar… --- ## [Use script in Logstash](https://discuss.elastic.co/t/use-script-in-logstash/121004)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 5\ **Last updated:** [February 28, 2018, 3:45pm UTC](https://discuss.elastic.co/t/use-script-in-logstash/121004 "2018-02-28T15:45:03Z")
Hello, I have a question, can we use a script in Logstash pipeline? I found that we can use ruby code in the pipeline but can we use another language or maybe execute the script file we want ? This is the pipeline I wa… --- ## [Uninstall elasticsearch and kibana](https://discuss.elastic.co/t/uninstall-elasticsearch-and-kibana/293106)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 6\ **Last updated:** [December 30, 2021, 3:39pm UTC](https://discuss.elastic.co/t/uninstall-elasticsearch-and-kibana/293106 "2021-12-30T15:39:36Z")
so I once had Elasticsearch and activated the trial license. After I uninstalled and reinstalled, this license still seems annoying. So how do I uninstall Elasticsearch completely clean, no more binding trial licenses? --- ## [Controlling the number of shard/index in Elasticsearch 5](https://discuss.elastic.co/t/controlling-the-number-of-shard-index-in-elasticsearch-5/65092)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 4\ **Last updated:** [November 6, 2016, 7:02pm UTC](https://discuss.elastic.co/t/controlling-the-number-of-shard-index-in-elasticsearch-5/65092 "2016-11-06T19:02:10Z")
Hello, Upgrading to ES 5 I've noticed that the elasticsearch.yml file has shrinked a bit. In particular, I can't find anymore these settings among the others: index.number\_of\_shards: 5 index.number\_of\_replicas: 1 Fr… --- ## [How to send logs to logstash from filebeat in the order they are printed in the log file](https://discuss.elastic.co/t/how-to-send-logs-to-logstash-from-filebeat-in-the-order-they-are-printed-in-the-log-file/155512)
**Author:** [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)\ **Replies:** 6\ **Last updated:** [November 21, 2018, 3:57am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-logstash-from-filebeat-in-the-order-they-are-printed-in-the-log-file/155512 "2018-11-21T03:57:51Z")
Description: In my system, I am using Filebeat, Logstash, Elasticsearch, and Kibana. For every transaction in the system, a log is printed in the log file and it is saved in the Elasticsearch db. There are around 200 … --- ## [Nested field in app search](https://discuss.elastic.co/t/nested-field-in-app-search/252233)
**Author:** [@Tam2](https://discuss.elastic.co/u/Tam2)\ **Replies:** 2\ **Last updated:** [October 23, 2020, 9:42am UTC](https://discuss.elastic.co/t/nested-field-in-app-search/252233 "2020-10-23T09:42:47Z")
What is best practice when needing to store data in a nested field for app search I have the following example, where the events key can hold an array of events How would i perform a search to find all documents wh… --- ## [Dejavu - a web UI for Elasticsearch](https://discuss.elastic.co/t/dejavu-a-web-ui-for-elasticsearch/51491)
**Author:** [@siddharthlatest](https://discuss.elastic.co/u/siddharthlatest)\ **Replies:** 4\ **Last updated:** [April 14, 2017, 9:33am UTC](https://discuss.elastic.co/t/dejavu-a-web-ui-for-elasticsearch/51491 "2017-04-14T09:33:10Z")
I would like to introduce dejavu, a modern data browser for viewing Elasticsearch data. It's open-source, available as an Elasticsearch plugin and as a chrome app. Since we launched it as an open-source project in March… --- ## [Export and import dashboard](https://discuss.elastic.co/t/export-and-import-dashboard/352445)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 2\ **Last updated:** [February 5, 2024, 10:58pm UTC](https://discuss.elastic.co/t/export-and-import-dashboard/352445 "2024-02-05T22:58:35Z")
Hi, I need to export three dashboards from cluster-A (on-prem v8.10.4) and import into cluster-B (cloud v8.11.1). What is the best way to do this? Although they're listed on "Saved Objects", I can't find a way to do th… --- ## [Can we use basic elastic package for commercial use](https://discuss.elastic.co/t/can-we-use-basic-elastic-package-for-commercial-use/192230)
**Author:** [@ragnar1290](https://discuss.elastic.co/u/ragnar1290)\ **Replies:** 2\ **Last updated:** [August 6, 2019, 10:46am UTC](https://discuss.elastic.co/t/can-we-use-basic-elastic-package-for-commercial-use/192230 "2019-08-06T10:46:28Z")
Hi Team, I want to know can we use basic package of elasticsearch,kibana and logstash for commercial use cases. --- ## [Config: Request failed with status code: 400](https://discuss.elastic.co/t/config-request-failed-with-status-code-400/141243)
**Author:** [@scch](https://discuss.elastic.co/u/scch)\ **Replies:** 4\ **Last updated:** [July 25, 2018, 5:14am UTC](https://discuss.elastic.co/t/config-request-failed-with-status-code-400/141243 "2018-07-25T05:14:34Z")
Kibana 6.3.1 Config: Request failed with status code: 400 Error: Request failed with status code: 400 \*\* at http://XXX.XXX.XXX.10:5601/bundles/commons.bundle.js:3:885489\*\* \*\* at tryCatch (http://XXX.XXX.XXX.10… --- ## [Scripted fields and fields not exists](https://discuss.elastic.co/t/scripted-fields-and-fields-not-exists/128660)
**Author:** [@marie](https://discuss.elastic.co/u/marie)\ **Replies:** 8\ **Last updated:** [April 19, 2018, 6:43pm UTC](https://discuss.elastic.co/t/scripted-fields-and-fields-not-exists/128660 "2018-04-19T18:43:36Z")
Hi, I want in kibana created a scripted field to know a time of resolution of a project. For that I writed this : Blockquote doc\['fields.LastDate'\].date.dayOfYear- doc\['fields.Bugdate'\].date.dayOfYear Blockquote … --- ## [Elasticsearch Output - Request size exceeded error](https://discuss.elastic.co/t/elasticsearch-output-request-size-exceeded-error/56322)
**Author:** [@Stephen\_Purr](https://discuss.elastic.co/u/Stephen_Purr)\ **Replies:** 8\ **Last updated:** [January 4, 2017, 7:19pm UTC](https://discuss.elastic.co/t/elasticsearch-output-request-size-exceeded-error/56322 "2017-01-04T19:19:56Z")
Hello everyone, Occasionally we've been seeing our logstash server stop processing logs from our redis queue and start to show some errors in its logs about request size being too large. This causes our logstash serve… --- ## [Input logs from Azure BLOB using logstash and output to ES](https://discuss.elastic.co/t/input-logs-from-azure-blob-using-logstash-and-output-to-es/171459)
**Author:** [@Prabhu2430](https://discuss.elastic.co/u/Prabhu2430)\ **Replies:** 5\ **Last updated:** [March 22, 2019, 12:56pm UTC](https://discuss.elastic.co/t/input-logs-from-azure-blob-using-logstash-and-output-to-es/171459 "2019-03-22T12:56:19Z")
Hi All, I have been trying to pull the logs of my webapp which is stored in my azure storage account {BLOB}. I am using the logstash-input-azureblob plugin which i have already installed. \[root@AZEUSELKVM01 ~\]# /usr/s… --- ## [Parse string data with ; separator in logstash](https://discuss.elastic.co/t/parse-string-data-with-separator-in-logstash/87524)
**Author:** [@Charlotte\_EGM](https://discuss.elastic.co/u/Charlotte_EGM)\ **Replies:** 5\ **Last updated:** [May 30, 2017, 3:02pm UTC](https://discuss.elastic.co/t/parse-string-data-with-separator-in-logstash/87524 "2017-05-30T15:02:39Z")
Hi, I'm trying to parse data that looks like this : “timestamp1;value1; timestamp2;value2;… timestampN;valueN;” I'm trying csv filter (as they originally comes from csv), but it is not working well,as it doesn't u… --- ## [Calculating aggs at each level of subaggregation](https://discuss.elastic.co/t/calculating-aggs-at-each-level-of-subaggregation/45385)
**Author:** [@elkcurious](https://discuss.elastic.co/u/elkcurious)\ **Replies:** 4\ **Last updated:** [May 27, 2017, 6:01am UTC](https://discuss.elastic.co/t/calculating-aggs-at-each-level-of-subaggregation/45385 "2017-05-27T06:01:10Z")
Hi, I have event data like this. And I need to calculate aggs at multiple levels of bucket aggregations. I cannot find a way to calculate aggs except at the "leaf level". { "id": 1, "field1" : "A1", "field2" : "B11… --- ## [Comparing 2 indices or 2 set of docs](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291)
**Author:** [@noelyim](https://discuss.elastic.co/u/noelyim)\ **Replies:** 5\ **Last updated:** [September 29, 2015, 2:46pm UTC](https://discuss.elastic.co/t/comparing-2-indices-or-2-set-of-docs/31291 "2015-09-29T14:46:17Z")
Continuing the discussion from Comparing 2 sources of log input ( using fuzzy? hash? term ?): So, I am trying to get a range of messages using timestamps from 2 different data source and compare them see if they match … --- ## [IP address in filebeat](https://discuss.elastic.co/t/ip-address-in-filebeat/134358)
**Author:** [@gbmzjy](https://discuss.elastic.co/u/gbmzjy)\ **Replies:** 3\ **Last updated:** [June 5, 2018, 6:21pm UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358 "2018-06-05T18:21:06Z")
Hi, I am using filebeat in the hosts. The filebeats will forward log files to elastic search server. In order to know where the logs come from the server side, I need filebeat to append IP address to the log before forwa… --- ## [Data type conversion issue](https://discuss.elastic.co/t/data-type-conversion-issue/138868)
**Author:** [@ajit](https://discuss.elastic.co/u/ajit)\ **Replies:** 8\ **Last updated:** [July 6, 2018, 1:53pm UTC](https://discuss.elastic.co/t/data-type-conversion-issue/138868 "2018-07-06T13:53:48Z")
Hi, I am getting long to float data type conversion error. I am using ELK 6.3.0 version. In logstash I have a sql jdbc configuration, and I am executing a query. But my few columns contains decimal values. And while push… --- ## [Issues with dates/times that don't have a timezone (Logstash/Kibana)](https://discuss.elastic.co/t/issues-with-dates-times-that-dont-have-a-timezone-logstash-kibana/66008)
**Author:** [@s33butler](https://discuss.elastic.co/u/s33butler)\ **Replies:** 7\ **Last updated:** [November 22, 2016, 12:21am UTC](https://discuss.elastic.co/t/issues-with-dates-times-that-dont-have-a-timezone-logstash-kibana/66008 "2016-11-22T00:21:11Z")
The basic issue is when I try and replace @timestamp with another date setting the timezone option all other dates are 5 hours off in Kibana because they are stored without a timezone and Kibana assumes they must be UT… --- ## [Introduction to machine learning](https://discuss.elastic.co/t/introduction-to-machine-learning/128859)
**Author:** [@1862347ba9566e72a47d](https://discuss.elastic.co/u/1862347ba9566e72a47d)\ **Replies:** 1\ **Last updated:** [April 20, 2018, 11:20am UTC](https://discuss.elastic.co/t/introduction-to-machine-learning/128859 "2018-04-20T11:20:37Z")
Tell me please, I'm interested in machine learning. Where can I get acquainted with the material on machine learning, which contains details of ML, then it is created, technical documentation, what neural networks are us… --- ## [120s Timeout on Elasticsearch Queries](https://discuss.elastic.co/t/120s-timeout-on-elasticsearch-queries/199735)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 5\ **Last updated:** [September 18, 2019, 12:41pm UTC](https://discuss.elastic.co/t/120s-timeout-on-elasticsearch-queries/199735 "2019-09-18T12:41:12Z")
I have two clusters (ES 7.3.1) that are hosted by an internal team here at my org. Each cluster has 6 data nodes, three master nodes, and one cluster has two client nodes that perform searches against both clusters simul… --- ## [Regex to match a specific key value pair in Logstash](https://discuss.elastic.co/t/regex-to-match-a-specific-key-value-pair-in-logstash/183167)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 8\ **Last updated:** [May 30, 2019, 12:56pm UTC](https://discuss.elastic.co/t/regex-to-match-a-specific-key-value-pair-in-logstash/183167 "2019-05-30T12:56:13Z")
I'm looking to remove specific key=value pair that are inside a STRING. Say, input event is as follows: { "ABC": "10119707", "Request\_StartTime": "1558952196175", "Severity": "INFO", "UUID": "481e8cfa-399c-4996-a4d… --- ## [Help needed with MUST\_NOT in a nested query](https://discuss.elastic.co/t/help-needed-with-must-not-in-a-nested-query/132643)
**Author:** [@ccverak\_microapps](https://discuss.elastic.co/u/ccverak_microapps)\ **Replies:** 3\ **Last updated:** [May 22, 2018, 3:30pm UTC](https://discuss.elastic.co/t/help-needed-with-must-not-in-a-nested-query/132643 "2018-05-22T15:30:18Z")
Hi there, I have a recipients index containing a nested activity object which stores event types and campaign ids. Here is an example: { email: 'm1@example.com', userId: 'user-id' listId: 'list-id' cam… [Previous page](https://discuss.elastic.co/top.md?page=369&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=371&per_page=50&period=all)