# Top **URL:** https://discuss.elastic.co/top.md?page=372&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 373 --- ## [How Update Type of field or Update all values of field](https://discuss.elastic.co/t/how-update-type-of-field-or-update-all-values-of-field/218760)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 4\ **Last updated:** [February 21, 2020, 5:16am UTC](https://discuss.elastic.co/t/how-update-type-of-field-or-update-all-values-of-field/218760 "2020-02-21T05:16:21Z")
Hello there! This is the current mappings for a index, and I want to update/edit date field from text to date GET testing/\_search "mappings" : { "inventory" : { "properties" : { "date… --- ## [Failed to obtain node lock](https://discuss.elastic.co/t/failed-to-obtain-node-lock/12608)
**Author:** [@Zoran\_Jeremic](https://discuss.elastic.co/u/Zoran_Jeremic)\ **Replies:** 6\ **Last updated:** [August 1, 2016, 7:54am UTC](https://discuss.elastic.co/t/failed-to-obtain-node-lock/12608 "2016-08-01T07:54:04Z")
Hi, I have the following problem if I'm using local node. It works find with elasticsearch server, but if I switch to the local node, then application creates 50 nodes, and the following error is fired: Excepti… --- ## [Setting script.max\_compilations\_per\_minute error](https://discuss.elastic.co/t/setting-script-max-compilations-per-minute-error/195344)
**Author:** [@PeterPain](https://discuss.elastic.co/u/PeterPain)\ **Replies:** 2\ **Last updated:** [August 16, 2019, 7:36am UTC](https://discuss.elastic.co/t/setting-script-max-compilations-per-minute-error/195344 "2019-08-16T07:36:26Z")
Hey Elastic-Team im getting following Error when changing the max\_compilations\_per\_minute via Kibana Following Syntax was used for the chaning the setting PUT /\_cluster/settings { "transient" : { "script.m… --- ## [Kibana KQL: how to search for fields with special characters (eg $)](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 2:16pm UTC](https://discuss.elastic.co/t/kibana-kql-how-to-search-for-fields-with-special-characters-eg/274598 "2021-06-17T14:16:28Z")
I've a search to look for Account names ending with $ (as they are computer generated names). Below is my simple search in KQL, but it provides both type of accounts (i.e with and without $ at the end). Escaping $ brings… --- ## [Metricbeat Failed to parse JSON response: invalid character '\<' looking for beginning of value error](https://discuss.elastic.co/t/metricbeat-failed-to-parse-json-response-invalid-character-looking-for-beginning-of-value-error/199248)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [September 12, 2019, 12:23pm UTC](https://discuss.elastic.co/t/metricbeat-failed-to-parse-json-response-invalid-character-looking-for-beginning-of-value-error/199248 "2019-09-12T12:23:23Z")
ECE 2.3 Metricbeat-oss-7.0 Started getting a "Failed to parse JSON response: invalid character '\<' looking for beginning of value" error in the metricbeat logs when sending data to a regular Elastic cluster and an ECE … --- ## [Unable to upgrade X-Pack license](https://discuss.elastic.co/t/unable-to-upgrade-x-pack-license/99282)
**Author:** [@patbre](https://discuss.elastic.co/u/patbre)\ **Replies:** 4\ **Last updated:** [September 5, 2017, 7:10pm UTC](https://discuss.elastic.co/t/unable-to-upgrade-x-pack-license/99282 "2017-09-05T19:10:39Z")
Hello, I have been using 30 days trial for X-Pack, which now has expired. I have registered and downloaded the Basic License and tried to upgrade it through license API (like in the Docs), but I encountered a problem. T… --- ## [Event time adjustment](https://discuss.elastic.co/t/event-time-adjustment/34156)
**Author:** [@Guy\_Wicks](https://discuss.elastic.co/u/Guy_Wicks)\ **Replies:** 0\ **Last updated:** [November 9, 2015, 2:20pm UTC](https://discuss.elastic.co/t/event-time-adjustment/34156 "2015-11-09T14:20:52Z")
I have standard Windows IIS log files with event date/time stamp information and timetaken (in milliseconds). I would like to be able to adjust the event time (@timestamp) by subtracting the "timetaken" to be able to r… --- ## [Error: illegal\_argument\_exception", "reason"=\> FIELD is not an IP string literal.?](https://discuss.elastic.co/t/error-illegal-argument-exception-reason-field-is-not-an-ip-string-literal/70664)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 3\ **Last updated:** [January 10, 2017, 8:19am UTC](https://discuss.elastic.co/t/error-illegal-argument-exception-reason-field-is-not-an-ip-string-literal/70664 "2017-01-10T08:19:20Z")
I have netflow and ipfix data coming in from logstash. When logstash tries to send this to elasticsearch I get these errors. I tried to tidy up my code using the alter filter instead of all the ifs' and mutate. I am gett… --- ## [Leap Day Issues?](https://discuss.elastic.co/t/leap-day-issues/43018)
**Author:** [@vzweits](https://discuss.elastic.co/u/vzweits)\ **Replies:** 3\ **Last updated:** [June 2, 2016, 1:50pm UTC](https://discuss.elastic.co/t/leap-day-issues/43018 "2016-06-02T13:50:04Z")
Just curious if anyone else is experiencing leap day issues. I'm creating a daily index with Logstash, so today's index looks something like logstash-{custom\_name}-2016.02.29 with "Index contains time-based events" enab… --- ## [Filebeat multi output](https://discuss.elastic.co/t/filebeat-multi-output/177307)
**Author:** [@Momo](https://discuss.elastic.co/u/Momo)\ **Replies:** 1\ **Last updated:** [April 17, 2019, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-multi-output/177307 "2019-04-17T16:48:23Z")
Hello, I have a filebeat that sends logs to logstash and elasticsearch. I would like to enable the haproxy module of filebeat to send the haproxy logs to elasticsearch but when I run the command: filebeat setup -e I h… --- ## [FileBeat Sends the same file content again and again](https://discuss.elastic.co/t/filebeat-sends-the-same-file-content-again-and-again/47219)
**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Replies:** 7\ **Last updated:** [April 13, 2016, 10:53am UTC](https://discuss.elastic.co/t/filebeat-sends-the-same-file-content-again-and-again/47219 "2016-04-13T10:53:13Z")
Hi, I have file beat agent running on one machine with conf as filebeat: prospectors: - paths: - /var/logs/apache/\*.log input\_type: log registry\_file: /var/lib/filebeat/registry outpu… --- ## [Is there any options for Kibana not to convert @timestamp from UTC to browser local timezone?](https://discuss.elastic.co/t/is-there-any-options-for-kibana-not-to-convert-timestamp-from-utc-to-browser-local-timezone/29368)
**Author:** [@11192](https://discuss.elastic.co/u/11192)\ **Replies:** 2\ **Last updated:** [September 16, 2015, 6:58am UTC](https://discuss.elastic.co/t/is-there-any-options-for-kibana-not-to-convert-timestamp-from-utc-to-browser-local-timezone/29368 "2015-09-16T06:58:40Z")
Continuing the discussion from Kibana Timezone: Is there any options for Kibana not to convert @timestamp from UTC to browser local timezone? --- ## [Importing Data from SQL to ElasticSearch?](https://discuss.elastic.co/t/importing-data-from-sql-to-elasticsearch/44320)
**Author:** [@PascalR](https://discuss.elastic.co/u/PascalR)\ **Replies:** 3\ **Last updated:** [March 21, 2016, 1:22pm UTC](https://discuss.elastic.co/t/importing-data-from-sql-to-elasticsearch/44320 "2016-03-21T13:22:31Z")
Hi, I'd like to know if there is a reliable way to synchronize data from a sql server to Elasticsearch? I've read something about some river plugins, especially a jdbc river to accomplish that. On the other hand I've r… --- ## [Infinite scroll best practices with ES](https://discuss.elastic.co/t/infinite-scroll-best-practices-with-es/20490)
**Author:** [@Driton\_Alija](https://discuss.elastic.co/u/Driton_Alija)\ **Replies:** 3\ **Last updated:** [November 12, 2014, 11:23pm UTC](https://discuss.elastic.co/t/infinite-scroll-best-practices-with-es/20490 "2014-11-12T23:23:14Z")
Hi All. I am new to this group and ES. I checked some of the topics in this forum but I wasn't able to find my answer that I needed. I except to have more than 1 million documents in my ES cluster and show t… --- ## [Regarding log4j vulnerability](https://discuss.elastic.co/t/regarding-log4j-vulnerability/291749)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 4\ **Last updated:** [January 5, 2022, 5:30pm UTC](https://discuss.elastic.co/t/regarding-log4j-vulnerability/291749 "2022-01-05T17:30:12Z")
Hello Team, I am using/running ELK 7.13 version on my environment using docker compose along with Filebeat 7.14 and have enabled xpack security option. I have restarted all three containers using docker compose and com… --- ## [Want to query combine bool and regexp](https://discuss.elastic.co/t/want-to-query-combine-bool-and-regexp/235507)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 5\ **Last updated:** [June 4, 2020, 9:19am UTC](https://discuss.elastic.co/t/want-to-query-combine-bool-and-regexp/235507 "2020-06-04T09:19:41Z")
My DSL is { "size": 10, "query":{ "bool": { "should": \[ {"match\_phrase\_prefix": {"status" : "3"} }, {"match\_phrase\_prefix": {"status" : "4"} } \] } }, "aggs": { "host": {… --- ## [restHighLevelClient connection refused](https://discuss.elastic.co/t/resthighlevelclient-connection-refused/183626)
**Author:** [@paklei](https://discuss.elastic.co/u/paklei)\ **Replies:** 5\ **Last updated:** [June 17, 2019, 4:51pm UTC](https://discuss.elastic.co/t/resthighlevelclient-connection-refused/183626 "2019-06-17T16:51:06Z")
I'm trying to implement a Spring Boot app that makes a bulk insert to an Elasticsearch instance installed on a local CentOS server. The problem that appears on app log is the following: "java.net.ConnectException: Cone… --- ## [Bulk thread pool rejections](https://discuss.elastic.co/t/bulk-thread-pool-rejections/16768)
**Author:** [@shift](https://discuss.elastic.co/u/shift)\ **Replies:** 4\ **Last updated:** [August 14, 2014, 1:50pm UTC](https://discuss.elastic.co/t/bulk-thread-pool-rejections/16768 "2014-08-14T13:50:26Z")
I am seeing a high number of rejections for the bulk thread pool on a 32 core system. Should I leave the thread pool size fixed to the # of cores and the default queue size at 50? Are these rejections re-processed?… --- ## [\[SOLVED\]\[ES 8.4.3\] Monitoring metricbeat - Unable to find the cluster in the selected time range](https://discuss.elastic.co/t/solved-es-8-4-3-monitoring-metricbeat-unable-to-find-the-cluster-in-the-selected-time-range/316247)
**Author:** [@mib](https://discuss.elastic.co/u/mib)\ **Replies:** 2\ **Last updated:** [October 13, 2022, 6:04am UTC](https://discuss.elastic.co/t/solved-es-8-4-3-monitoring-metricbeat-unable-to-find-the-cluster-in-the-selected-time-range/316247 "2022-10-13T06:04:12Z")
Hi, I'm having a problem displaying monitoring on an Elasticsearch cluster (3 nodes), with the error message "Unable to find the cluster in the selected time range. UUID: 1xTxMsopToqNnvd\_mbmcHw HTTP 404" when I visit th… --- ## [How to determine if field contains a value?](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 3\ **Last updated:** [August 24, 2017, 2:38pm UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842 "2017-08-24T14:38:55Z")
Hello, Here’s my sample data in a field called “additional text” “additionalText” : \[ "A “commonMIBAlarm” event has occurred, from xxxxxx device, named xxxxxx Severity=major ComponentID=Navigation System&Name=Navigati… --- ## [Having clause equivalent](https://discuss.elastic.co/t/having-clause-equivalent/32295)
**Author:** [@gilt](https://discuss.elastic.co/u/gilt)\ **Replies:** 3\ **Last updated:** [October 19, 2015, 1:23pm UTC](https://discuss.elastic.co/t/having-clause-equivalent/32295 "2015-10-19T13:23:02Z")
hi everyone, i am new to elasticsearch. i am trying to do something like a keep alive track from a service, it sends every X minutes a new record to ES. i want to query all the servers that did not send this message in t… --- ## [Logstash 7.2.0 install error](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 11:33pm UTC](https://discuss.elastic.co/t/logstash-7-2-0-install-error/188356 "2021-01-29T23:33:41Z")
I was upgrading whole stack to 7.2.0 and got following error Updating / installing... 1:logstash-1:7.2.0-1 ################################# \[ 17%\] Using provided startup.options file: /etc/logstash/star… --- ## [Using elasticsearch to find duplicates in dataset](https://discuss.elastic.co/t/using-elasticsearch-to-find-duplicates-in-dataset/8483)
**Author:** [@Schmurfy](https://discuss.elastic.co/u/Schmurfy)\ **Replies:** 6\ **Last updated:** [July 24, 2012, 12:57pm UTC](https://discuss.elastic.co/t/using-elasticsearch-to-find-duplicates-in-dataset/8483 "2012-07-24T12:57:35Z")
Hello, I am currently evaluating elasticsearch for a very specific task which is removing duplicates from a contacts list, from my initial tests it looks like it would works but there are still some shadows I hope … --- ## [Date range filtering does not affect date histogram aggregation](https://discuss.elastic.co/t/date-range-filtering-does-not-affect-date-histogram-aggregation/112241)
**Author:** [@valdemarrolfsen](https://discuss.elastic.co/u/valdemarrolfsen)\ **Replies:** 0\ **Last updated:** [December 18, 2017, 1:51pm UTC](https://discuss.elastic.co/t/date-range-filtering-does-not-affect-date-histogram-aggregation/112241 "2017-12-18T13:51:28Z")
I have some issues with filtering on a nested date field when doing aggregations. I want to separate the filtering and aggregation logic so that I can use the same filtering for different aggregations. This has been poss… --- ## [How to use docker without xpack features (aka how to make the license expiration message go away)](https://discuss.elastic.co/t/how-to-use-docker-without-xpack-features-aka-how-to-make-the-license-expiration-message-go-away/147236)
**Author:** [@bluecoffee](https://discuss.elastic.co/u/bluecoffee)\ **Replies:** 5\ **Last updated:** [September 7, 2018, 10:11am UTC](https://discuss.elastic.co/t/how-to-use-docker-without-xpack-features-aka-how-to-make-the-license-expiration-message-go-away/147236 "2018-09-07T10:11:40Z")
Problem: I run an ElasticSearch instance in a docker container. I am not using any xpack.security features (or at least, not knowingly - that may be the problem...). I keep getting License Expiration warnings: elastics… --- ## [Unable to fetch data from reporting collector"](https://discuss.elastic.co/t/unable-to-fetch-data-from-reporting-collector/170308)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 5\ **Last updated:** [March 4, 2019, 2:44pm UTC](https://discuss.elastic.co/t/unable-to-fetch-data-from-reporting-collector/170308 "2019-03-04T14:44:40Z")
Hi everybody, the kibana doesnt start in the last days the error is the following: feb 28 09:50:25 ganondorf kibana\[14813\]: {"type":"error","@timestamp":"2019-02-28T09:50:25Z","tags":\["warning","stats-collection"\],"pi… --- ## [Elasticsearch 8.9.1 / 7.17.13 Security Update](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [September 18, 2023, 8:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297 "2023-09-18T20:40:51Z")
Elasticsearch StackOverflow vulnerability (ESA-2023-14) A flaw was discovered in Elasticsearch, affecting the \_search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of… --- ## [Auto-logout in Elastic managed service Kibana](https://discuss.elastic.co/t/auto-logout-in-elastic-managed-service-kibana/255092)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 8\ **Last updated:** [December 8, 2020, 5:09pm UTC](https://discuss.elastic.co/t/auto-logout-in-elastic-managed-service-kibana/255092 "2020-12-08T17:09:11Z")
Hi, I'm presenting a Kibana dashboard on television and after like 6 hours the session automatically logouts and requires to log in again with username and password. I'd like to disable the session from disconnection o… --- ## [COMBINEDAPACHELOG grok definition creating all fields as type string](https://discuss.elastic.co/t/combinedapachelog-grok-definition-creating-all-fields-as-type-string/70630)
**Author:** [@hp-adl](https://discuss.elastic.co/u/hp-adl)\ **Replies:** 2\ **Last updated:** [January 9, 2017, 3:49am UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-creating-all-fields-as-type-string/70630 "2017-01-09T03:49:43Z")
Hi all, I'm using the %{COMBINEDAPACHELOG} grok pattern for my Apache logs and parsing to Elasticsearch service (v2.3) in AWS and all the fields are created as string type. I have tried a number of custom patterns and … --- ## [Want to capture timeStamp without milliseconds](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 5\ **Last updated:** [July 28, 2015, 1:39pm UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389 "2015-07-28T13:39:35Z")
The CSV contains timeStamp field whose format is "yyyy/MM/dd HH:mm:ss.SSS" I want to capture only "yyyy/MM/dd HH:mm:ss" Used below config but it didn't work. filter { if (\[message\] =~ "responseCode") { drop… --- ## [Logstash fails to start | Multiple pipelines](https://discuss.elastic.co/t/logstash-fails-to-start-multiple-pipelines/130250)
**Author:** [@Deepak\_Singh](https://discuss.elastic.co/u/Deepak_Singh)\ **Replies:** 8\ **Last updated:** [May 28, 2018, 4:43am UTC](https://discuss.elastic.co/t/logstash-fails-to-start-multiple-pipelines/130250 "2018-05-28T04:43:26Z")
Hi, I am trying to set up multiple pipelines, as described here : https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html I have set up the .conf and pipelines.yml file correctly, but when try to start… --- ## [Encountered an unexpected error submitting a bulk request! Will retry](https://discuss.elastic.co/t/encountered-an-unexpected-error-submitting-a-bulk-request-will-retry/71642)
**Author:** [@nbari](https://discuss.elastic.co/u/nbari)\ **Replies:** 6\ **Last updated:** [February 1, 2017, 2:06pm UTC](https://discuss.elastic.co/t/encountered-an-unexpected-error-submitting-a-bulk-request-will-retry/71642 "2017-02-01T14:06:02Z")
I am installing/testing logstash 5.1.1 I am available to send the logs to elasticsearch this is my output: output { elasticsearch { timeout =\> 30 hosts =\> \["10.10.23.183"\] index =\> "logstash-… --- ## [Attempted to send a bulk request to elasticsearch, but no there are no living connections in the connection pool](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-no-there-are-no-living-connections-in-the-connection-pool/277307)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 1:50am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-no-there-are-no-living-connections-in-the-connection-pool/277307 "2021-07-15T01:50:43Z")
I am getting the following error in the log of logstash. $ tail /var/log/logstash/logstash-plain.log \[2021-06-29T01:17:53,584\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[9acc851acb29a066b989c90cdd9ba461ce676a2f7643e20… --- ## [Not able to create a cluster with ES 5.6?](https://discuss.elastic.co/t/not-able-to-create-a-cluster-with-es-5-6/100917)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 8\ **Last updated:** [September 19, 2017, 8:18am UTC](https://discuss.elastic.co/t/not-able-to-create-a-cluster-with-es-5-6/100917 "2017-09-19T08:18:21Z")
Hi Experts , I got 2 nodes for testing purpose and I have new installation of ES 5.6 . I am using below elasticsearch.yml on both the machines . First node cluster.name: e-2 path.logs: /opt/es/2/es\_logs bootstrap.memo… --- ## [How to make my filebeat read from the beginning in log file](https://discuss.elastic.co/t/how-to-make-my-filebeat-read-from-the-beginning-in-log-file/154930)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 3\ **Last updated:** [November 2, 2018, 10:23am UTC](https://discuss.elastic.co/t/how-to-make-my-filebeat-read-from-the-beginning-in-log-file/154930 "2018-11-02T10:23:19Z")
How to make my filebeat read from the beginning in log file everytime. i am using filebeat client node is sending CSV formatted log file to the logstash node and i have CSV filter in logstash which is creating fields a… --- ## [Failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/283809)
**Author:** [@plaroche0](https://discuss.elastic.co/u/plaroche0)\ **Replies:** 5\ **Last updated:** [September 13, 2021, 7:55pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/283809 "2021-09-13T19:55:37Z")
I have filebeat installed on a Syncplify server. It will send a couple of logs to ES and then nothing else. The service says it is still running. If I restart the service I get a couple more logs and then nothing unless … --- ## [How to convert geoip's ingest plugin data into "geo\_point" type?](https://discuss.elastic.co/t/how-to-convert-geoips-ingest-plugin-data-into-geo-point-type/74224)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 8\ **Last updated:** [February 10, 2017, 10:35am UTC](https://discuss.elastic.co/t/how-to-convert-geoips-ingest-plugin-data-into-geo-point-type/74224 "2017-02-10T10:35:20Z")
Hello, I am using "geoip" ingest plugin to obtain coordinates for a given IP (excerpt from my pipeline): "geoip" : { "field" : "ip", "target\_field" : "geoip", "properties": \[ "location" \] }, I… --- ## [Clearpass logs \[SOLVED\]](https://discuss.elastic.co/t/clearpass-logs-solved/149906)
**Author:** [@Dr\_Natas](https://discuss.elastic.co/u/Dr_Natas)\ **Replies:** 6\ **Last updated:** [September 27, 2018, 10:39pm UTC](https://discuss.elastic.co/t/clearpass-logs-solved/149906 "2018-09-27T22:39:10Z")
This is my first grok filter, if any one has any input I'm more than welcome to receive any. I'm able to parse a good portion of Aruba Clearpass logs but this field I'm unable split it by columns e.g. I would like to … --- ## [Validate data before indexing them](https://discuss.elastic.co/t/validate-data-before-indexing-them/15825)
**Author:** [@Thierry\_Templier](https://discuss.elastic.co/u/Thierry_Templier)\ **Replies:** 4\ **Last updated:** [March 7, 2014, 4:19pm UTC](https://discuss.elastic.co/t/validate-data-before-indexing-them/15825 "2014-03-07T16:19:41Z")
Hello, I wonder if there is a built-in way to validate data before indexing them. I see two kinds of validation: \* Structural validation of fields based on a regular expression for example. Perhaps something ca… --- ## [Need help to calculate time delta in ES/Kibana](https://discuss.elastic.co/t/need-help-to-calculate-time-delta-in-es-kibana/85924)
**Author:** [@uttkarshd](https://discuss.elastic.co/u/uttkarshd)\ **Replies:** 5\ **Last updated:** [May 22, 2017, 4:34pm UTC](https://discuss.elastic.co/t/need-help-to-calculate-time-delta-in-es-kibana/85924 "2017-05-22T16:34:46Z")
Hi, I need some help to calculate time difference in one of our indexes. These are application logs, where the application creates and deletes new virtual machines. The log format is as follows: @timestamp … --- ## [Logstash creates switch case using ruby code](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581)
**Author:** [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\ **Replies:** 6\ **Last updated:** [August 5, 2019, 3:03pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581 "2019-08-05T15:03:49Z")
Hi all, Trying to do something like a switch case as below : if value \< 1 then field = 'low' else if value \>= 1 && \< 20 then field = 'medium' else if value \>= 20 && \< 50 then field = 'high' else field = 'veryHigh' but… --- ## [Convert netsted array into fields using Logstash](https://discuss.elastic.co/t/convert-netsted-array-into-fields-using-logstash/91528)
**Author:** [@JukeBox](https://discuss.elastic.co/u/JukeBox)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 12:10pm UTC](https://discuss.elastic.co/t/convert-netsted-array-into-fields-using-logstash/91528 "2017-07-03T12:10:56Z")
Hi, I'm trying to convert an array with data keys and values into fields with the same name, but keep getting errors or problem with the Ruby filter plugin. I'll explain with example, I'm trying to take this json: { … --- ## [Dec 24th, 2021: \[en\] Elastic Docs - give the gift of feedback](https://discuss.elastic.co/t/dec-24th-2021-en-elastic-docs-give-the-gift-of-feedback/292183)
**Author:** [@OliverHowell](https://discuss.elastic.co/u/OliverHowell)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 3:11pm UTC](https://discuss.elastic.co/t/dec-24th-2021-en-elastic-docs-give-the-gift-of-feedback/292183 "2022-01-10T15:11:26Z")
'Twas the night before Christmas, when all through Elastic Not a creature was typing, not even a mouse; The docs were hung by the website with care In hopes our users would soon read it there; The writers were nestle… --- ## [Elasticsearch 5.6 Installation - single node](https://discuss.elastic.co/t/elasticsearch-5-6-installation-single-node/118549)
**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\ **Replies:** 4\ **Last updated:** [February 7, 2018, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-5-6-installation-single-node/118549 "2018-02-07T11:43:06Z")
I am trying to install ES 5.6 as a single node and currently would like to explore in development mode. Once known to be a stable application after necessary checks for indices, later would like to switch to production m… --- ## [Logstash.pipeline error: A plugin had an unrecoverable error](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228)
**Author:** [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Replies:** 3\ **Last updated:** [March 3, 2017, 6:00pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-a-plugin-had-an-unrecoverable-error/77228 "2017-03-03T18:00:04Z")
I am setting up a demo for our CEO to review - Kibana dasboard. I have this installed on a local server and have filebeat installed on that elk server to create logs for the Kibana demo. It was working yesterday and I ha… --- ## [Enrich documents by copying fields from another index](https://discuss.elastic.co/t/enrich-documents-by-copying-fields-from-another-index/170882)
**Author:** [@biconou](https://discuss.elastic.co/u/biconou)\ **Replies:** 8\ **Last updated:** [February 12, 2020, 7:59am UTC](https://discuss.elastic.co/t/enrich-documents-by-copying-fields-from-another-index/170882 "2020-02-12T07:59:44Z")
Hi, I got 2 indices. say index1 and index2. When I index a new document in index2, I want some fields to be copied from the document in index1 having the same \_id. I previously realized this using logstash + the elas… --- ## [Tuning : index\_buffer\_size and active shards](https://discuss.elastic.co/t/tuning-index-buffer-size-and-active-shards/36576)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 8\ **Last updated:** [January 10, 2017, 2:44am UTC](https://discuss.elastic.co/t/tuning-index-buffer-size-and-active-shards/36576 "2017-01-10T02:44:58Z")
Hello, We're going to put in place a write heavy cluster for logs storage using logstash. So, I saw that it's recommended to increase the indexing buffer. But I'm a bit puzzled about the fact that this space is divid… --- ## [Install winlogbeat on windows server 2003 without powershell](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 7\ **Last updated:** [October 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506 "2017-10-06T13:53:32Z")
I have a server with windows server 2003 installed and I need to forward that server windows event logs to logstash through winlogbeat. But there is no powershell in windows server 2003. So how can I install winlogbeat… --- ## [Quick example on Group By Filter for Time Series Visualization](https://discuss.elastic.co/t/quick-example-on-group-by-filter-for-time-series-visualization/88083)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 1\ **Last updated:** [June 2, 2017, 1:01pm UTC](https://discuss.elastic.co/t/quick-example-on-group-by-filter-for-time-series-visualization/88083 "2017-06-02T13:01:30Z")
I'm trying to find a good example of how to use the Query String for the 'Group By Filter' in the Time Series Visual Builder. Essentially, I'd like to Filter upon a basic Count aggregation, and utilize the Query String… --- ## [Path.repo is set but cannot create snapshot](https://discuss.elastic.co/t/path-repo-is-set-but-cannot-create-snapshot/63659)
**Author:** [@Christopher\_Cheng](https://discuss.elastic.co/u/Christopher_Cheng)\ **Replies:** 4\ **Last updated:** [October 22, 2016, 7:21am UTC](https://discuss.elastic.co/t/path-repo-is-set-but-cannot-create-snapshot/63659 "2016-10-22T07:21:56Z")
I have set path.repo in elasticsearch.yml and I can see that in http://127.0.0.1:9200/\_nodes/?pretty "path" : { "data" : "/var/lib/elasticsearch", "home" : "/usr/share/elasticsearch", "… [Previous page](https://discuss.elastic.co/top.md?page=371&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=373&per_page=50&period=all)