# Top **URL:** https://discuss.elastic.co/top.md?page=389&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 390 --- ## [Can FileBeat correctly handle log rotation and network disruption/failure mode?](https://discuss.elastic.co/t/can-filebeat-correctly-handle-log-rotation-and-network-disruption-failure-mode/87314)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 4\ **Last updated:** [May 31, 2017, 7:46pm UTC](https://discuss.elastic.co/t/can-filebeat-correctly-handle-log-rotation-and-network-disruption-failure-mode/87314 "2017-05-31T19:46:18Z")
Hello, there, In our log system, our local log files is automatically rotated, for example, every hour or every midnight, the current log file (e.g., myapp.log) will be renamed (maybe be also compressed) to myapp.l… --- ## [Difference between the timeout param mentioned in query-string parameters and request body](https://discuss.elastic.co/t/difference-between-the-timeout-param-mentioned-in-query-string-parameters-and-request-body/208217)
**Author:** [@amitmbm](https://discuss.elastic.co/u/amitmbm)\ **Replies:** 0\ **Last updated:** [November 17, 2019, 11:00am UTC](https://discuss.elastic.co/t/difference-between-the-timeout-param-mentioned-in-query-string-parameters-and-request-body/208217 "2019-11-17T11:00:23Z")
I am trying to understand the ES timeout and found different resources which talked about different things. Timeout param in query String As per this ES doc: The timeout parameter tells shards how long they are allowe… --- ## [Filebeat connection refused eof](https://discuss.elastic.co/t/filebeat-connection-refused-eof/43914)
**Author:** [@cernicb](https://discuss.elastic.co/u/cernicb)\ **Replies:** 6\ **Last updated:** [March 18, 2016, 8:37am UTC](https://discuss.elastic.co/t/filebeat-connection-refused-eof/43914 "2016-03-18T08:37:11Z")
We use filebeat -\> logstash to transport logs to graylog. As soon as filebeat logs: Error publishing events (retrying): EOF it is followed by: Connecting error publishing events (retrying): dial tcp y.y.y.y:5043: g… --- ## [Disadvantages of using nested type over flat type mapping](https://discuss.elastic.co/t/disadvantages-of-using-nested-type-over-flat-type-mapping/159498)
**Author:** [@SankalpSood](https://discuss.elastic.co/u/SankalpSood)\ **Replies:** 2\ **Last updated:** [December 5, 2018, 10:19am UTC](https://discuss.elastic.co/t/disadvantages-of-using-nested-type-over-flat-type-mapping/159498 "2018-12-05T10:19:28Z")
Please tell me the disadvantages of using nested type mapping in terms of- response time data integrity transaction consistency data lay out querying data --- ## [Kibana 6.4.2 plugin:security Privileges are missing and can't be removed, currently](https://discuss.elastic.co/t/kibana-6-4-2-plugin-security-privileges-are-missing-and-cant-be-removed-currently/160650)
**Author:** [@samwato](https://discuss.elastic.co/u/samwato)\ **Replies:** 2\ **Last updated:** [December 13, 2018, 12:57pm UTC](https://discuss.elastic.co/t/kibana-6-4-2-plugin-security-privileges-are-missing-and-cant-be-removed-currently/160650 "2018-12-13T12:57:33Z")
Was running on Elastic Cloud 6.4.2 Received error when logged into Kibana. No known cause. plugin:security@6.4.3 | Privileges are missing and can't be removed, currently. Tried Updating to 6.5.3 to fix error but Kiban… --- ## [Send Log data from multiple files with different indices without logstash](https://discuss.elastic.co/t/send-log-data-from-multiple-files-with-different-indices-without-logstash/221648)
**Author:** [@CLehmann](https://discuss.elastic.co/u/CLehmann)\ **Replies:** 8\ **Last updated:** [March 2, 2020, 7:05pm UTC](https://discuss.elastic.co/t/send-log-data-from-multiple-files-with-different-indices-without-logstash/221648 "2020-03-02T19:05:53Z")
My goal is to use filebeat to take multiple log files, and send them to elastic search without logstash. Here is my filebeat.yml: filebeat.inputs: - type: log enabled: true paths: - /usr/share/filebeat… --- ## [Excel (.xlsx) filter](https://discuss.elastic.co/t/excel-xlsx-filter/1081)
**Author:** [@whittssg](https://discuss.elastic.co/u/whittssg)\ **Replies:** 3\ **Last updated:** [March 1, 2016, 10:53am UTC](https://discuss.elastic.co/t/excel-xlsx-filter/1081 "2016-03-01T10:53:42Z")
Hello, Is there any filters or plugins for logstash that can parse excel (.xlsx) files? I looked around but could only find a CSV filter. Thanks, --- ## [Spike Detection in a Time-Series](https://discuss.elastic.co/t/spike-detection-in-a-time-series/2626)
**Author:** [@Sandipan\_Basu](https://discuss.elastic.co/u/Sandipan_Basu)\ **Replies:** 4\ **Last updated:** [July 19, 2017, 2:54am UTC](https://discuss.elastic.co/t/spike-detection-in-a-time-series/2626 "2017-07-19T02:54:26Z")
Hi there, I am trying to build a watch which alerts on spikes (both up or down) over a time series of a specific field. To illustrate this with an example if my values of a field say cpu is \[20,23,24,25,50,52,18,19,20,… --- ## [Curator run failing with NewConnectionError(urllib3.connection.HTTPConnection)](https://discuss.elastic.co/t/curator-run-failing-with-newconnectionerror-urllib3-connection-httpconnection/190745)
**Author:** [@sanooprajps](https://discuss.elastic.co/u/sanooprajps)\ **Replies:** 7\ **Last updated:** [July 17, 2019, 9:53am UTC](https://discuss.elastic.co/t/curator-run-failing-with-newconnectionerror-urllib3-connection-httpconnection/190745 "2019-07-17T09:53:00Z")
Hello, When I am trying to delete index on ELK single node cluster using curator it is failing with below error. I know it is a common error having many threads, but I am not able to find a proper solution for any. Whe… --- ## [Logstash parsing syslog to different indices depending on source hosts](https://discuss.elastic.co/t/logstash-parsing-syslog-to-different-indices-depending-on-source-hosts/92069)
**Author:** [@tias](https://discuss.elastic.co/u/tias)\ **Replies:** 5\ **Last updated:** [July 11, 2017, 3:20pm UTC](https://discuss.elastic.co/t/logstash-parsing-syslog-to-different-indices-depending-on-source-hosts/92069 "2017-07-11T15:20:35Z")
Hello everyone, I have the following logstash config: input { udp { type =\> "syslog" port =\> 5140 } } filter { if \[type\] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslo… --- ## [SearchContextMissingException: No search context found](https://discuss.elastic.co/t/searchcontextmissingexception-no-search-context-found/24826)
**Author:** [@dave](https://discuss.elastic.co/u/dave)\ **Replies:** 3\ **Last updated:** [July 6, 2015, 9:00pm UTC](https://discuss.elastic.co/t/searchcontextmissingexception-no-search-context-found/24826 "2015-07-06T21:00:46Z")
Hey! I ran a search query on multiple indices, in parallel with a delete index query on those indices. The search failed with this error: \[2015-06-15 23:51:53,696\]\[INFO \]\[cluster.metadata \] \[node-ba3d5edd-4e7e-… --- ## [Regular expression doesnt work in Kibana Search panel](https://discuss.elastic.co/t/regular-expression-doesnt-work-in-kibana-search-panel/1656)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 3\ **Last updated:** [June 1, 2015, 5:23pm UTC](https://discuss.elastic.co/t/regular-expression-doesnt-work-in-kibana-search-panel/1656 "2015-06-01T17:23:27Z")
Hi All As we have a search panel in Kibana Discovery tab, i want to search Phone Number In my current dataset I have certain Phone Number which is not numeric, i want to sort out which are non-numeric For this I am… --- ## [Performance difference between Java High Level REST Client vs Low Level REST Client](https://discuss.elastic.co/t/performance-difference-between-java-high-level-rest-client-vs-low-level-rest-client/125775)
**Author:** [@mhmtnlr](https://discuss.elastic.co/u/mhmtnlr)\ **Replies:** 3\ **Last updated:** [April 6, 2018, 12:46pm UTC](https://discuss.elastic.co/t/performance-difference-between-java-high-level-rest-client-vs-low-level-rest-client/125775 "2018-04-06T12:46:56Z")
Hello, I was doing a performance test on my system. In my test, Java High-Level Client makes ~800 RPS for a simple get request. When I change the implementation and use Java Low-Level Client, it reaches to ~1750 RPS. Wh… --- ## [What is the best way to transfer data when you change your cluster name?](https://discuss.elastic.co/t/what-is-the-best-way-to-transfer-data-when-you-change-your-cluster-name/24506)
**Author:** [@GordonM](https://discuss.elastic.co/u/GordonM)\ **Replies:** 6\ **Last updated:** [June 30, 2015, 3:22pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-transfer-data-when-you-change-your-cluster-name/24506 "2015-06-30T15:22:40Z")
What is the best way to transfer data when you change your cluster name? I am working on a cluster with just a single node for development. I tried changing my cluster name, and copied the entire nodes folder from /v… --- ## [How to resolve the below unassigned shards?](https://discuss.elastic.co/t/how-to-resolve-the-below-unassigned-shards/268037)
**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\ **Replies:** 5\ **Last updated:** [March 23, 2021, 5:22am UTC](https://discuss.elastic.co/t/how-to-resolve-the-below-unassigned-shards/268037 "2021-03-23T05:22:03Z")
How do I resolve the below unassigned shards ? What exactly happened - one of the node in the cluster was down for 2days and I bought the node back again. After above issue - I could see shards got unassigned. Again I… --- ## [Logstash-input-jdbc plugin](https://discuss.elastic.co/t/logstash-input-jdbc-plugin/38306)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 5\ **Last updated:** [February 9, 2016, 7:08am UTC](https://discuss.elastic.co/t/logstash-input-jdbc-plugin/38306 "2016-02-09T07:08:56Z")
Hi All, I am trying to install plugins required for Logstash on my Company's desktop(Windows) where the installation of plugins through command prompt is restricted. Just wanted to know how the plugins could be install… --- ## [Kibana support array of JSON object](https://discuss.elastic.co/t/kibana-support-array-of-json-object/127866)
**Author:** [@DravenJohnson](https://discuss.elastic.co/u/DravenJohnson)\ **Replies:** 4\ **Last updated:** [April 17, 2018, 7:06pm UTC](https://discuss.elastic.co/t/kibana-support-array-of-json-object/127866 "2018-04-17T19:06:35Z")
We have a data that looks like this: { "data1": "something", "data2":"something", "students": \[{ "name": "peter", "age": 9, "school": "school1" }, { "name": "kevel", "age": 4, … --- ## [Need to send json in watcher webhook](https://discuss.elastic.co/t/need-to-send-json-in-watcher-webhook/52646)
**Author:** [@elasticbharat](https://discuss.elastic.co/u/elasticbharat)\ **Replies:** 4\ **Last updated:** [September 21, 2016, 11:10am UTC](https://discuss.elastic.co/t/need-to-send-json-in-watcher-webhook/52646 "2016-09-21T11:10:05Z")
I want to send json data in body of watcher webhook. I am defining action like below my json body should be like {'watcher\_id':24} The following action is returning 404 error. "actions" : { "my\_webhook" : { "… --- ## [Are Multiple Master Nodes in a single Cluster allowed?](https://discuss.elastic.co/t/are-multiple-master-nodes-in-a-single-cluster-allowed/39778)
**Author:** [@Harish\_Ramanathan](https://discuss.elastic.co/u/Harish_Ramanathan)\ **Replies:** 1\ **Last updated:** [January 21, 2016, 2:45pm UTC](https://discuss.elastic.co/t/are-multiple-master-nodes-in-a-single-cluster-allowed/39778 "2016-01-21T14:45:29Z")
I am new to Elasticsearch. I would like to understand if it is possible to set up 3 Master nodes as part of the same cluster. If possible, what would be the advantage/ use case scenario that prompts multiple Master node… --- ## [ELK It's broken, rerouting shards:high disk watermark exceeded on one or more nodes](https://discuss.elastic.co/t/elk-its-broken-rerouting-shards-high-disk-watermark-exceeded-on-one-or-more-nodes/140991)
**Author:** [@omid](https://discuss.elastic.co/u/omid)\ **Replies:** 6\ **Last updated:** [July 22, 2018, 12:28pm UTC](https://discuss.elastic.co/t/elk-its-broken-rerouting-shards-high-disk-watermark-exceeded-on-one-or-more-nodes/140991 "2018-07-22T12:28:03Z")
my elk elasticsearch, kibana, logstash, is up services but elasticsearch log is : \> \[2018-07-21T15:53:40,353\]\[WARN \]\[o.e.c.r.a.DiskThresholdMonitor\] \[\_POGvYv\] high disk watermark \[90%\] exceeded on \[\_POGvYvXQsK4h8… --- ## [How to delete elasticsearch from ubuntu 22.04 completely to install it again](https://discuss.elastic.co/t/how-to-delete-elasticsearch-from-ubuntu-22-04-completely-to-install-it-again/308243)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 2\ **Last updated:** [June 28, 2022, 9:41am UTC](https://discuss.elastic.co/t/how-to-delete-elasticsearch-from-ubuntu-22-04-completely-to-install-it-again/308243 "2022-06-28T09:41:31Z")
how to delete elasticsearch from ubuntu 22.04 completely to install it again --- ## [Regexp support for matching at the beginning (^) and the end ($)](https://discuss.elastic.co/t/regexp-support-for-matching-at-the-beginning-and-the-end/45030)
**Author:** [@Jinwu](https://discuss.elastic.co/u/Jinwu)\ **Replies:** 3\ **Last updated:** [March 22, 2016, 10:25pm UTC](https://discuss.elastic.co/t/regexp-support-for-matching-at-the-beginning-and-the-end/45030 "2016-03-22T22:25:14Z")
I tried to use a regular expression ^10AB\[0-9\]{8}$ to match string that start with "10AB" and end with 8 digits, but seems Elasticsearch does not support "^" and "$" to match at the beginning and end. If I do not use "^… --- ## [How to update date field in elasticsearch if it has "-"](https://discuss.elastic.co/t/how-to-update-date-field-in-elasticsearch-if-it-has/42999)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 6\ **Last updated:** [March 1, 2016, 10:04am UTC](https://discuss.elastic.co/t/how-to-update-date-field-in-elasticsearch-if-it-has/42999 "2016-03-01T10:04:34Z")
I have data in my Elastic index as below : Indexed data as: curl -XPUT 'http://localhost:9200/twitter/tweet/1' -d '{ "user" : "kimchy", "post\_date" : "2009-11-15T14:12:12", "message" : "trying out Elasticse… --- ## [Querying records having colon : characters in Elasticsearch](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401)
**Author:** [@asatsi](https://discuss.elastic.co/u/asatsi)\ **Replies:** 5\ **Last updated:** [October 2, 2015, 1:38am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401 "2015-10-02T01:38:20Z")
Hi, I am getting very strange results when I query a record which contains a Mac Address having multiple colon characters e.g. 80:c5:e6:36:6a:b4 using the query -\> bool -\> must -\> match query via Curl. I tried escaping… --- ## [How to convert a json field to string by using ruby filter?](https://discuss.elastic.co/t/how-to-convert-a-json-field-to-string-by-using-ruby-filter/46206)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 3\ **Last updated:** [April 5, 2016, 7:31am UTC](https://discuss.elastic.co/t/how-to-convert-a-json-field-to-string-by-using-ruby-filter/46206 "2016-04-05T07:31:27Z")
Hi all. I have a event like: {"@timestamp":"2016-04-03T08:17:15.202Z","host":"shifudao","type":"rtds","loglevel":"WARN","classname":"hawkeyes.rtds.gate.protocol.frametype.SamplerReportData","logdetail":{"message":"设备0… --- ## [Can aggregation return the documents in each bucket?](https://discuss.elastic.co/t/can-aggregation-return-the-documents-in-each-bucket/16443)
**Author:** [@Erich\_Lin](https://discuss.elastic.co/u/Erich_Lin)\ **Replies:** 7\ **Last updated:** [October 2, 2014, 12:30pm UTC](https://discuss.elastic.co/t/can-aggregation-return-the-documents-in-each-bucket/16443 "2014-10-02T12:30:23Z")
It seems aggregation will return the count of documents for each bucket. Can I also retrieve the documents within each bucket that matched that bucket criteria? -- You received this message because you are subs… --- ## [Unable to login when disk is full](https://discuss.elastic.co/t/unable-to-login-when-disk-is-full/257314)
**Author:** [@hazcod](https://discuss.elastic.co/u/hazcod)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 12:40pm UTC](https://discuss.elastic.co/t/unable-to-login-when-disk-is-full/257314 "2020-12-03T12:40:10Z")
Hi, I am unable to login into Kibana when my elasticsearch cluster is getting full. The log will contain: org.elasticsearch.xpack.monitoring.exporter.ExportException: CLusterBlockException: blocked by: \[TOO\_MANY\_REQUE… --- ## [Multiple conditions with autodiscover & docker containers](https://discuss.elastic.co/t/multiple-conditions-with-autodiscover-docker-containers/153634)
**Author:** [@vieskees](https://discuss.elastic.co/u/vieskees)\ **Replies:** 2\ **Last updated:** [October 25, 2018, 8:09am UTC](https://discuss.elastic.co/t/multiple-conditions-with-autodiscover-docker-containers/153634 "2018-10-25T08:09:59Z")
Hi! I've just set up our ELK stack and I'm struggling with selecting the right containers for the autodiscover setting. I have a application consisting of around 20+ different containers. And around 10 of these containe… --- ## [High Level Rest Client - admin API?](https://discuss.elastic.co/t/high-level-rest-client-admin-api/100461)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 6\ **Last updated:** [November 13, 2017, 8:54am UTC](https://discuss.elastic.co/t/high-level-rest-client-admin-api/100461 "2017-11-13T08:54:06Z")
Does the new High Level Rest Client provide an admin API for creating/deleting/updating indices? The documentation indicates that it has no support for admin operations, but I wanted to make sure. --- ## [Remove fields from documents based on their value](https://discuss.elastic.co/t/remove-fields-from-documents-based-on-their-value/200270)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 7\ **Last updated:** [September 19, 2019, 7:54pm UTC](https://discuss.elastic.co/t/remove-fields-from-documents-based-on-their-value/200270 "2019-09-19T19:54:49Z")
I am using Logstash to read JSON data and load it to ElasticSearch. I am using a combination of update with doc\_as\_upsert to update existing documents and insert new. The specific application need is that in Elastic the… --- ## [100% Stacked Bar Chart for Date Histogram data?](https://discuss.elastic.co/t/100-stacked-bar-chart-for-date-histogram-data/155240)
**Author:** [@Jonathan\_Rice](https://discuss.elastic.co/u/Jonathan_Rice)\ **Replies:** 3\ **Last updated:** [November 6, 2018, 12:54am UTC](https://discuss.elastic.co/t/100-stacked-bar-chart-for-date-histogram-data/155240 "2018-11-06T00:54:39Z")
I have some time-series data which features several numerical values in each document whose relative ratios I wish to view over time. I want to bucket the data over time (x axis), and draw bars in the y direction to repr… --- ## [Upgrading Elasticsearch on Windows from zip install](https://discuss.elastic.co/t/upgrading-elasticsearch-on-windows-from-zip-install/164354)
**Author:** [@nahallac](https://discuss.elastic.co/u/nahallac)\ **Replies:** 3\ **Last updated:** [January 16, 2019, 8:52am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-on-windows-from-zip-install/164354 "2019-01-16T08:52:28Z")
Hi all, I am in the process of planning an upgrade from an Elastic Stack installed before my time. I've got all of the relevant upgrade docs (starting with the upgrade guide), but have a question about upgrading using t… --- ## [Create multiple indexes with same logstash config file](https://discuss.elastic.co/t/create-multiple-indexes-with-same-logstash-config-file/97456)
**Author:** [@elk12](https://discuss.elastic.co/u/elk12)\ **Replies:** 1\ **Last updated:** [August 17, 2017, 7:42pm UTC](https://discuss.elastic.co/t/create-multiple-indexes-with-same-logstash-config-file/97456 "2017-08-17T19:42:41Z")
Hello, I am looking for some help in creating a muliple indexes in ES with just single logstash config file. All dev logs should go to dev index , all sys logs should to sys index and uat logs to uat index. The logstas… --- ## [Trying to get my docker-compose to start Kibana with ssl](https://discuss.elastic.co/t/trying-to-get-my-docker-compose-to-start-kibana-with-ssl/296568)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 8\ **Last updated:** [March 2, 2022, 11:26pm UTC](https://discuss.elastic.co/t/trying-to-get-my-docker-compose-to-start-kibana-with-ssl/296568 "2022-03-02T23:26:44Z")
Hi All I'm trying to set up my kibana to use SSL for 7.16.3, like I set up Elasticsearch. So I used this guide : Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide \[7.17\] | Elastic to… --- ## [Is it possible to perform bulk insert from Spark to ElasticSearch?](https://discuss.elastic.co/t/is-it-possible-to-perform-bulk-insert-from-spark-to-elasticsearch/25174)
**Author:** [@diplomaticguru](https://discuss.elastic.co/u/diplomaticguru)\ **Replies:** 3\ **Last updated:** [July 14, 2015, 6:33am UTC](https://discuss.elastic.co/t/is-it-possible-to-perform-bulk-insert-from-spark-to-elasticsearch/25174 "2015-07-14T06:33:05Z")
Is it possible perform bulk insert from Spark to ElasticSearch? At the moment, I'm using the 'saveToEsWithMeta' method for upserting the data(JavaPairRDD). Is there a way to bulk insert using the \_bulk API? Are there a… --- ## [How can I ingest pre-existing log files into Elasticsearch for analysis?](https://discuss.elastic.co/t/how-can-i-ingest-pre-existing-log-files-into-elasticsearch-for-analysis/152897)
**Author:** [@pojoguy](https://discuss.elastic.co/u/pojoguy)\ **Replies:** 5\ **Last updated:** [October 18, 2018, 8:05am UTC](https://discuss.elastic.co/t/how-can-i-ingest-pre-existing-log-files-into-elasticsearch-for-analysis/152897 "2018-10-18T08:05:44Z")
I need to digest logs offline into ELK for analysis. I'm a relative newbie to the ELK architecture, and floundering a bit. I would greatly appreciate any input My problem is I have been sent a mass of historical log fil… --- ## [Methods in Logstash Ruby](https://discuss.elastic.co/t/methods-in-logstash-ruby/102144)
**Author:** [@fluffierbump](https://discuss.elastic.co/u/fluffierbump)\ **Replies:** 6\ **Last updated:** [November 2, 2017, 9:18pm UTC](https://discuss.elastic.co/t/methods-in-logstash-ruby/102144 "2017-11-02T21:18:11Z")
I'm trying to get methods working in Logstash Ruby and I'm starting with a very simple one def output\_something(value) puts value end Then I call the method and try to create a field with a value from it event.set… --- ## [Parsing message with plain text and json](https://discuss.elastic.co/t/parsing-message-with-plain-text-and-json/172261)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 8\ **Last updated:** [March 15, 2019, 2:00pm UTC](https://discuss.elastic.co/t/parsing-message-with-plain-text-and-json/172261 "2019-03-15T14:00:01Z")
Hello, I have to filter one log which is mix of plain text and the json message. So the sample is \[ERROR\] ABCD posting failed! { StatusCodeError: 422 - {"error":{"message":"Duplicated ticket","status\_code":422}} Can … --- ## [Logstash to parse xml file](https://discuss.elastic.co/t/logstash-to-parse-xml-file/140147)
**Author:** [@saisimo02](https://discuss.elastic.co/u/saisimo02)\ **Replies:** 5\ **Last updated:** [July 18, 2018, 7:45am UTC](https://discuss.elastic.co/t/logstash-to-parse-xml-file/140147 "2018-07-18T07:45:12Z")
I am new on ELK, and I need a help to use Kibana. I have 5 fields; one for the name of data, and for each name there is different type, and for each type there is different value for each object. My xml file is like that… --- ## [Best way to query nested objects in indexes where they don't exist](https://discuss.elastic.co/t/best-way-to-query-nested-objects-in-indexes-where-they-dont-exist/157923)
**Author:** [@wparad](https://discuss.elastic.co/u/wparad)\ **Replies:** 4\ **Last updated:** [December 3, 2018, 11:49am UTC](https://discuss.elastic.co/t/best-way-to-query-nested-objects-in-indexes-where-they-dont-exist/157923 "2018-12-03T11:49:39Z")
Right now it seems like I need to create a new nested property and add that to every index I have. Otherwise the "\[nested\] failed to find nested object under path \[MY\_OBJECT\_PATH\]" This topic which was closed: and th… --- ## [Does Logstash (7.0.1) support gzip file input?](https://discuss.elastic.co/t/does-logstash-7-0-1-support-gzip-file-input/181862)
**Author:** [@nobound](https://discuss.elastic.co/u/nobound)\ **Replies:** 6\ **Last updated:** [May 23, 2019, 5:49pm UTC](https://discuss.elastic.co/t/does-logstash-7-0-1-support-gzip-file-input/181862 "2019-05-23T17:49:01Z")
Hi all, It seems there are issues regarding gzip file support, but I can't really find any post that will give me the answer. I have tried to use gzip\_lines codec. It does not work. input { file { path =\> "… --- ## [Root mapping definition has unsupported parameters: \[\_size : {enabled=true}\]](https://discuss.elastic.co/t/root-mapping-definition-has-unsupported-parameters-size-enabled-true/193971)
**Author:** [@loknath\_sudhakar](https://discuss.elastic.co/u/loknath_sudhakar)\ **Replies:** 5\ **Last updated:** [August 28, 2019, 7:04am UTC](https://discuss.elastic.co/t/root-mapping-definition-has-unsupported-parameters-size-enabled-true/193971 "2019-08-28T07:04:22Z")
Hello, I have installed ES 6.5.4 in my cluster. Also installed Size plugin 6.5.4. After restarting the cluster, tried creating an index with mappings as follows: PUT test\_index/ { "mappings": { "my\_type": { … --- ## [How to uninstall Logstash](https://discuss.elastic.co/t/how-to-uninstall-logstash/265280)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 10:20am UTC](https://discuss.elastic.co/t/how-to-uninstall-logstash/265280 "2021-02-24T10:20:10Z")
I want to know how to uninstall Logstash in the Ubuntu server? --- ## [Number Of Occurrences Of A Particular Word in a field](https://discuss.elastic.co/t/number-of-occurrences-of-a-particular-word-in-a-field/129569)
**Author:** [@Michel\_Budimbu-Esuku](https://discuss.elastic.co/u/Michel_Budimbu-Esuku)\ **Replies:** 5\ **Last updated:** [May 11, 2018, 7:32am UTC](https://discuss.elastic.co/t/number-of-occurrences-of-a-particular-word-in-a-field/129569 "2018-05-11T07:32:18Z")
I index my emails in Kibana. And I would like to know the number of times that the word "timeout" appears in "Emailbody" field. { "From":"string", "To" : "string", "Date" "date" "Emailbody": "string" } Thank you i… --- ## [How to enable deprecation logging in Elasticsearch 6.8?](https://discuss.elastic.co/t/how-to-enable-deprecation-logging-in-elasticsearch-6-8/197550)
**Author:** [@dstromberg](https://discuss.elastic.co/u/dstromberg)\ **Replies:** 7\ **Last updated:** [September 18, 2019, 9:23am UTC](https://discuss.elastic.co/t/how-to-enable-deprecation-logging-in-elasticsearch-6-8/197550 "2019-09-18T09:23:44Z")
Ultimately, I want to upgrade a bunch of Python code that uses Elasticsearch 6.8 to use Elasticsearch 7.3. Toward that goal, I want to enable Elasticsearch 6.8 "deprecation logging". It seems likely to be the best place… --- ## [Automatic dashboard export from command line - using python](https://discuss.elastic.co/t/automatic-dashboard-export-from-command-line-using-python/234076)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [May 27, 2020, 10:16pm UTC](https://discuss.elastic.co/t/automatic-dashboard-export-from-command-line-using-python/234076 "2020-05-27T22:16:49Z")
Many people has ask this questions in past. I have search around for same for many days and didn't find right answer or proper explanation. I am not good in python but used it and implemented my solution. posting it he… --- ## [Using authentication api of kibana /api/security/v1/login returns 404 not found](https://discuss.elastic.co/t/using-authentication-api-of-kibana-api-security-v1-login-returns-404-not-found/246920)
**Author:** [@Ananya\_Chaurasia](https://discuss.elastic.co/u/Ananya_Chaurasia)\ **Replies:** 5\ **Last updated:** [September 4, 2020, 3:17pm UTC](https://discuss.elastic.co/t/using-authentication-api-of-kibana-api-security-v1-login-returns-404-not-found/246920 "2020-09-04T15:17:21Z")
I am running Kibana 7.7.1 on windows. I am trying to share kibana dashboard to external web app by embedding the iframe into my angular code. This approach has an issue of Kibana login prompt appearing everytime I visit … --- ## [Dashboard kibana in a html file](https://discuss.elastic.co/t/dashboard-kibana-in-a-html-file/38991)
**Author:** [@v.montaldo](https://discuss.elastic.co/u/v.montaldo)\ **Replies:** 5\ **Last updated:** [January 14, 2016, 11:32am UTC](https://discuss.elastic.co/t/dashboard-kibana-in-a-html-file/38991 "2016-01-14T11:32:26Z")
hi, I try to create a html file and to insert a kibana dashboard (ex:) but when I filter in kibana the src change (ex:) but i cant' recover from html file the iframe src filtered of kibana. I would recover into html … --- ## [Unable to access 'path.repo'](https://discuss.elastic.co/t/unable-to-access-path-repo/95453)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [August 2, 2017, 6:48am UTC](https://discuss.elastic.co/t/unable-to-access-path-repo/95453 "2017-08-02T06:48:44Z")
I have been trying to configure snapshot on my cluster. But I am stumped at this error. org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Unable to access 'path.repo' (/home/elastic/mount/ba… --- ## [Kibana Email Alert](https://discuss.elastic.co/t/kibana-email-alert/303013)
**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\ **Replies:** 7\ **Last updated:** [June 3, 2022, 9:42am UTC](https://discuss.elastic.co/t/kibana-email-alert/303013 "2022-06-03T09:42:48Z")
Hi Guys, I hope someone can shed some light on a strange thing. Long story short: I would like to receive Email-alerts whenever a certain Event-ID has been triggered. In my case Event ID: 4672 (with this information pa… [Previous page](https://discuss.elastic.co/top.md?page=388&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=390&per_page=50&period=all)