# Top **URL:** https://discuss.elastic.co/top.md?page=391&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 392 --- ## [Load balancing with a single Logstash output](https://discuss.elastic.co/t/load-balancing-with-a-single-logstash-output/55756)
**Author:** [@joshuaspence](https://discuss.elastic.co/u/joshuaspence)\ **Replies:** 5\ **Last updated:** [July 21, 2016, 2:51pm UTC](https://discuss.elastic.co/t/load-balancing-with-a-single-logstash-output/55756 "2016-07-21T14:51:59Z")
I am trying to use Filebeat and have the output (Logstash) hosts queried via Consul's DNS interface. My Filebeat configuration looks like this: --- filebeat: spool\_size: 2048 idle\_timeout: '10s' registry\_file: '.… --- ## [Issue in ElasticSearch Cluster](https://discuss.elastic.co/t/issue-in-elasticsearch-cluster/129308)
**Author:** [@Rajashree\_Sekar](https://discuss.elastic.co/u/Rajashree_Sekar)\ **Replies:** 6\ **Last updated:** [April 26, 2018, 1:02pm UTC](https://discuss.elastic.co/t/issue-in-elasticsearch-cluster/129308 "2018-04-26T13:02:29Z")
Could not form a cluster with 1 master node and two data nodes . Im creating cluster inside vbox. Getting Handshake exception. Please help me to solve the issue. Master Node yml file: cluster.name: CRIST node.name: e… --- ## [Mustache template to access timestamp field](https://discuss.elastic.co/t/mustache-template-to-access-timestamp-field/143195)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 7\ **Last updated:** [August 7, 2018, 1:42pm UTC](https://discuss.elastic.co/t/mustache-template-to-access-timestamp-field/143195 "2018-08-07T13:42:39Z")
I want to create a watch that generates an action for a certain event, but I want to format the output using a mustache template. In the output I want to be able to say when each event happened, e.g. {{#ctx.payload.hit… --- ## [How to split a JSON array inside an object](https://discuss.elastic.co/t/how-to-split-a-json-array-inside-an-object/25511)
**Author:** [@joerno](https://discuss.elastic.co/u/joerno)\ **Replies:** 1\ **Last updated:** [November 23, 2016, 1:05am UTC](https://discuss.elastic.co/t/how-to-split-a-json-array-inside-an-object/25511 "2016-11-23T01:05:13Z")
I have a JSON-Message with an array in an array. I want to split that into multiple events (because of kibana): { "type": "monitor", "server": "10.111.222.333", "host": "abc.de", "bean": \[{ "name": "beanName1", … --- ## [Why does filebeat only need cert and metricbeat need key, ca and cert? \[RESOLVED\]](https://discuss.elastic.co/t/why-does-filebeat-only-need-cert-and-metricbeat-need-key-ca-and-cert-resolved/104214)
**Author:** [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Replies:** 6\ **Last updated:** [October 27, 2017, 12:52pm UTC](https://discuss.elastic.co/t/why-does-filebeat-only-need-cert-and-metricbeat-need-key-ca-and-cert-resolved/104214 "2017-10-27T12:52:22Z")
I am quite new to the whole ELK stack, and i just managed to set up both filebeat and metricbeat to connect to a remote ELK stack. All v6.0.0-rc1 The SSL setup got me a bit confused, and I am left with the question: Wh… --- ## [How to debug Elasticsearch in IDEA?](https://discuss.elastic.co/t/how-to-debug-elasticsearch-in-idea/51642)
**Author:** [@Clay](https://discuss.elastic.co/u/Clay)\ **Replies:** 7\ **Last updated:** [June 2, 2016, 9:50am UTC](https://discuss.elastic.co/t/how-to-debug-elasticsearch-in-idea/51642 "2016-06-02T09:50:22Z")
Hi there, I got an errot when I was trying to start elasticsearch from source code which was the latest version I cloned from github. Elasticesearch will run successfully if I run the gradle run command. But it wil… --- ## [Is it safe to expose Elasticsearch to the Internet?](https://discuss.elastic.co/t/is-it-safe-to-expose-elasticsearch-to-the-internet/247041)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 5:29am UTC](https://discuss.elastic.co/t/is-it-safe-to-expose-elasticsearch-to-the-internet/247041 "2020-09-01T05:29:47Z")
TLDR - Elasticsearch is not designed to be exposed to the internet. To dig into this with more detail, here's more information taken from this topic. This page in the docs says: NOTE: Elasticsearch installations are … --- ## [Error with dissect filter \[SOLVED\]](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368)
**Author:** [@dr01](https://discuss.elastic.co/u/dr01)\ **Replies:** 8\ **Last updated:** [June 11, 2018, 2:33pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368 "2018-06-11T14:33:41Z")
I am trying to parse this message: Summary for local -------------- Succeeded: 478 (changed=180) Failed: 0 -------------- Total states run: 478 Total run time: 68.410 s \[Tue, 05 Jun 2018 14:33:17 +0200\] codedeploy-agent… --- ## [Raw twitter river date format](https://discuss.elastic.co/t/raw-twitter-river-date-format/29201)
**Author:** [@Chinch\_Pokli](https://discuss.elastic.co/u/Chinch_Pokli)\ **Replies:** 7\ **Last updated:** [September 22, 2015, 8:29am UTC](https://discuss.elastic.co/t/raw-twitter-river-date-format/29201 "2015-09-22T08:29:50Z")
Hi, I am trying to index the raw Twitter data. Twitter returns the date in the format "Sun Sep 13 19:12:56 +0000 2015" and for that I have PUT mapping for my index with date as format "EEE MMM dd HH:mm:ss +ZZZZZ yyyy".… --- ## [Groking of cisco switch logs (non asa)](https://discuss.elastic.co/t/groking-of-cisco-switch-logs-non-asa/119485)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 0\ **Last updated:** [February 12, 2018, 2:44pm UTC](https://discuss.elastic.co/t/groking-of-cisco-switch-logs-non-asa/119485 "2018-02-12T14:44:06Z")
Hi just wanted to give something back to the community here is the grok and pattern file that i got things working with. if there are a shorter/better way to do this please feel free to amend the post. I thought this wa… --- ## [How to resolve elasticsearch status red](https://discuss.elastic.co/t/how-to-resolve-elasticsearch-status-red/14885)
**Author:** [@xiaoliang\_tian](https://discuss.elastic.co/u/xiaoliang_tian)\ **Replies:** 3\ **Last updated:** [December 18, 2013, 6:08am UTC](https://discuss.elastic.co/t/how-to-resolve-elasticsearch-status-red/14885 "2013-12-18T06:08:36Z")
I have one master 1 data and 1 search node,Then are running on AWS During indexing ,cluster status became from green to red,and there is part of unassigned shards,I terminated the only data node by mistake,and start… --- ## [Add core type - guid](https://discuss.elastic.co/t/add-core-type-guid/16810)
**Author:** [@Vladimir\_Khazin](https://discuss.elastic.co/u/Vladimir_Khazin)\ **Replies:** 5\ **Last updated:** [April 4, 2014, 9:32pm UTC](https://discuss.elastic.co/t/add-core-type-guid/16810 "2014-04-04T21:32:04Z")
\*Sample data:\* "\_source": { "Id": "ca23459f-cc96-46cb-8ae8-509368467670", "Title": "TPTest Scaling 10:3" } \*Trouble:\* Guid is not one of the supported data types: htt… --- ## [Set the global log level to ERROR](https://discuss.elastic.co/t/set-the-global-log-level-to-error/103655)
**Author:** [@1222kkk](https://discuss.elastic.co/u/1222kkk)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 1:49pm UTC](https://discuss.elastic.co/t/set-the-global-log-level-to-error/103655 "2017-10-13T13:49:13Z")
hi all, I just wonder how to set the global log level of elastisearch. I found the configure file of log via ${es\_home}/conf/log4j2.properties. As the showing below: status = error # log action execution errors for e… --- ## [Search query exception "org.elasticsearch.index.query.QueryShardException: failed to create query"](https://discuss.elastic.co/t/search-query-exception-org-elasticsearch-index-query-queryshardexception-failed-to-create-query/225820)
**Author:** [@Suchita\_Gangurde](https://discuss.elastic.co/u/Suchita_Gangurde)\ **Replies:** 7\ **Last updated:** [April 2, 2020, 4:55am UTC](https://discuss.elastic.co/t/search-query-exception-org-elasticsearch-index-query-queryshardexception-failed-to-create-query/225820 "2020-04-02T04:55:32Z")
Hello, I am using elasticsearch version 7.3.1, on my local setup search query execution works fine. But the same query using docker image for es version 7.3.1 on kubernetes recently I am facing following exception: "m… --- ## [Get nested object fields with java api, addfields doesnt work](https://discuss.elastic.co/t/get-nested-object-fields-with-java-api-addfields-doesnt-work/2580)
**Author:** [@andimak](https://discuss.elastic.co/u/andimak)\ **Replies:** 1\ **Last updated:** [June 13, 2015, 10:20pm UTC](https://discuss.elastic.co/t/get-nested-object-fields-with-java-api-addfields-doesnt-work/2580 "2015-06-13T22:20:51Z")
hi, I have some documents like that with nested objects: \_score": 1, "\_source": { "name": "andi", "age": "51", "adresses": \[ { "town": "berlin", … --- ## [Unable to parse TIMESTAMP\_ISO8601 timestamp in logstash conf](https://discuss.elastic.co/t/unable-to-parse-timestamp-iso8601-timestamp-in-logstash-conf/267886)
**Author:** [@Micheal25](https://discuss.elastic.co/u/Micheal25)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 7:52pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-iso8601-timestamp-in-logstash-conf/267886 "2021-03-20T19:52:59Z")
Hi Team, I am having parsing the "TIMESTAMP\_ISO8601" in logstash grok. The only differnce i see in the log message is extra space after the hours : in timestamp Eg: 2021-03-21T13:(\\s) 01:54.402+0000 this is occuring … --- ## [Indent any json file nested fields and make it flat](https://discuss.elastic.co/t/indent-any-json-file-nested-fields-and-make-it-flat/194447)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 5\ **Last updated:** [August 8, 2019, 7:33pm UTC](https://discuss.elastic.co/t/indent-any-json-file-nested-fields-and-make-it-flat/194447 "2019-08-08T19:33:06Z")
I have the following json code, it has a nested fields and I'm trying to make it flat but I couldn't! Here is the source json file { "body": { "BlockName": "SA", "input": { "type": "arra… --- ## [Deployement not getting completed error message 0 of 1 pod is not available,](https://discuss.elastic.co/t/deployement-not-getting-completed-error-message-0-of-1-pod-is-not-available/272794)
**Author:** [@Snehil03](https://discuss.elastic.co/u/Snehil03)\ **Replies:** 4\ **Last updated:** [May 21, 2021, 3:16pm UTC](https://discuss.elastic.co/t/deployement-not-getting-completed-error-message-0-of-1-pod-is-not-available/272794 "2021-05-21T15:16:56Z")
Hello, I am trying to fix the kibana setup but seems to be it's not working , I have updated the module from 7.6.0 to 7.7.0 but after the update pods does not get started. I am using terraform to do these setup . Kind… --- ## [Filebeat ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/filebeat-err-failed-to-publish-events-caused-by-eof/70893)
**Author:** [@Gude.ravi](https://discuss.elastic.co/u/Gude.ravi)\ **Replies:** 7\ **Last updated:** [January 10, 2017, 11:32am UTC](https://discuss.elastic.co/t/filebeat-err-failed-to-publish-events-caused-by-eof/70893 "2017-01-10T11:32:50Z")
The following is my filebeat yml. The error I am seeing is . Filebeat - ERR Failed to publish events caused by: EOF I understand its a connection closing issue by logstash. I do see the data in elasticsearch. what can b… --- ## [Logs are indexed into logstash indices but not showing in kibana dashboard?](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 8\ **Last updated:** [July 22, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015 "2020-07-22T13:25:10Z")
logs are showing in index in Discover page. but not showing in dashboard. need help? here are my index patterns: here are log lines : but here in dashboard i can't see. --- ## [\[SPARK\] es.batch.write.retry.count negative value is ignored](https://discuss.elastic.co/t/spark-es-batch-write-retry-count-negative-value-is-ignored/25436)
**Author:** [@angel\_ft](https://discuss.elastic.co/u/angel_ft)\ **Replies:** 6\ **Last updated:** [July 29, 2015, 8:07pm UTC](https://discuss.elastic.co/t/spark-es-batch-write-retry-count-negative-value-is-ignored/25436 "2015-07-29T20:07:38Z")
Hi, We are testing a indexing pipeline where data would be processed by spark, enriched, and sent to Elasticsearch for indexing. We are having recurrent org.elasticsearch.hadoop.rest.EsHadoopNoNodesLeftException errors… --- ## [One Logstash file with multiple logs entries/pipelines](https://discuss.elastic.co/t/one-logstash-file-with-multiple-logs-entries-pipelines/108991)
**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Replies:** 7\ **Last updated:** [November 24, 2017, 11:43am UTC](https://discuss.elastic.co/t/one-logstash-file-with-multiple-logs-entries-pipelines/108991 "2017-11-24T11:43:52Z")
Hi, I have two different logs source ( Syslogs;logstash-syslog.conf, Apache logs;logstash-apache.conf), and i want to get the syslogs and apache logs into logstash and then ship them to elasticsearch with one logstash i… --- ## [Unable to start Elastic.service 'setting \[cluster.initial\_master\_nodes\] is not allowed when \[discovery.type\] is set to \[single-node\]'](https://discuss.elastic.co/t/unable-to-start-elastic-service-setting-cluster-initial-master-nodes-is-not-allowed-when-discovery-type-is-set-to-single-node/314375)
**Author:** [@Neophyte](https://discuss.elastic.co/u/Neophyte)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 6:59am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-service-setting-cluster-initial-master-nodes-is-not-allowed-when-discovery-type-is-set-to-single-node/314375 "2022-09-14T06:59:35Z")
I am trying to set up a SIEM HOME LAB environment and install the latest Elastic and kibana on Ubuntu, but the service is not starting up, and am receiving the following errors: messi@fifa:~/Desktop$ sudo systemctl rest… --- ## [Shard stuck in INITIALIZING](https://discuss.elastic.co/t/shard-stuck-in-initializing/61907)
**Author:** [@TeePee](https://discuss.elastic.co/u/TeePee)\ **Replies:** 4\ **Last updated:** [October 6, 2016, 9:52am UTC](https://discuss.elastic.co/t/shard-stuck-in-initializing/61907 "2016-10-06T09:52:17Z")
Hi guys, I'm having an issue that I tried multiple approachs and I'm unable to find a proper solution. I thought it was something with unassigned shards: curl -XGET 'http://183.\*.\*.200:9200/\_cluster/health?pretty&l… --- ## ["Unknown key for a START\_ARRAY in in json](https://discuss.elastic.co/t/unknown-key-for-a-start-array-in-in-json/230091)
**Author:** [@vinay123](https://discuss.elastic.co/u/vinay123)\ **Replies:** 7\ **Last updated:** [April 28, 2020, 10:12am UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-array-in-in-json/230091 "2020-04-28T10:12:55Z")
Hello Team , i have a large json file which has nested kind of, the start of json file has array. when i a writing a search query i am getting error as Unknown key for a START\_ARRAY parsing issue. any suggestions to… --- ## [Watcher email to show every hit's message separately](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985)
**Author:** [@Jiawen](https://discuss.elastic.co/u/Jiawen)\ **Replies:** 3\ **Last updated:** [September 24, 2015, 3:42am UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985 "2015-09-24T03:42:10Z")
I have build a watcher on my ES master node. And use email as action, to collect all the error event in last minute. Then I found there will be dozens of hits in one minute. Like: my-watch executed with 19 hits ctx.paylo… --- ## [Pipe syslog into Redis](https://discuss.elastic.co/t/pipe-syslog-into-redis/26363)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 5\ **Last updated:** [July 29, 2015, 8:50pm UTC](https://discuss.elastic.co/t/pipe-syslog-into-redis/26363 "2015-07-29T20:50:32Z")
Hello, I am just starting out with ELK and have a question that I can't seem to find an answer to. This is my first post, so I hope this is the right spot to ask. I've looked at the Logstash Book by James Turnbull and … --- ## [Use Json input convert bytes to GB](https://discuss.elastic.co/t/use-json-input-convert-bytes-to-gb/231330)
**Author:** [@Jan\_Svajcik](https://discuss.elastic.co/u/Jan_Svajcik)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 1:34pm UTC](https://discuss.elastic.co/t/use-json-input-convert-bytes-to-gb/231330 "2020-05-06T13:34:32Z")
Hello please i am beginner for elastics I created metric for sum filesize , but I have count in bytes I need in GB how should i write json input ? Soory for my Englisch , thank you --- ## [Performance of update\_by\_query operation](https://discuss.elastic.co/t/performance-of-update-by-query-operation/129285)
**Author:** [@vangap](https://discuss.elastic.co/u/vangap)\ **Replies:** 4\ **Last updated:** [April 28, 2018, 2:24am UTC](https://discuss.elastic.co/t/performance-of-update-by-query-operation/129285 "2018-04-28T02:24:28Z")
Let's say I have an index with 100 Million docs and I want to update all of them using update\_by\_query. I could create single update by query(UBQ) that affect all the docs in the index or I could create 10 UBQ tasks one… --- ## [Unknown setting \[thread\_pool.bulk.queue\_size\]](https://discuss.elastic.co/t/unknown-setting-thread-pool-bulk-queue-size/180120)
**Author:** [@cmcdowell03](https://discuss.elastic.co/u/cmcdowell03)\ **Replies:** 5\ **Last updated:** [May 8, 2019, 9:01am UTC](https://discuss.elastic.co/t/unknown-setting-thread-pool-bulk-queue-size/180120 "2019-05-08T09:01:33Z")
java.lang.IllegalArgumentException: unknown setting \[thread\_pool.bulk.queue\_size\] did you mean any of \[thread\_pool.get.queue\_size, thread\_pool.write.queue\_size, thread\_pool.analyze.queue\_size, thread\_pool.search.queue\_si… --- ## [\[invalid\_type\_name\_exception\] Document mapping type name can't start with '\_'](https://discuss.elastic.co/t/invalid-type-name-exception-document-mapping-type-name-cant-start-with--/63626)
**Author:** [@Nkuli\_Stunna](https://discuss.elastic.co/u/Nkuli_Stunna)\ **Replies:** 2\ **Last updated:** [October 23, 2016, 7:52am UTC](https://discuss.elastic.co/t/invalid-type-name-exception-document-mapping-type-name-cant-start-with--/63626 "2016-10-23T07:52:15Z")
I am new to Kibana and trying to use the Kibana Graph Plugin I keep getting this error : \[invalid\_type\_name\_exception\] Document mapping type name can't start with '\_' and I am not sure what the problem is --- ## [Failed to create native process factories for Machine Learning](https://discuss.elastic.co/t/failed-to-create-native-process-factories-for-machine-learning/98798)
**Author:** [@tempname](https://discuss.elastic.co/u/tempname)\ **Replies:** 7\ **Last updated:** [October 4, 2017, 8:24am UTC](https://discuss.elastic.co/t/failed-to-create-native-process-factories-for-machine-learning/98798 "2017-10-04T08:24:24Z")
Windows 10 x64, elastic search 5.5.2, kibana 5.5.2, java 1.8u144 what is this error? i want to use the machine learning feature... this is my log \[log\] --- ## [Logstash docker error -\> exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 1, column 1 (byte 1)"](https://discuss.elastic.co/t/logstash-docker-error-exception-logstash-configurationerror-message-expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/255210)
**Author:** [@s0umen](https://discuss.elastic.co/u/s0umen)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 11:55am UTC](https://discuss.elastic.co/t/logstash-docker-error-exception-logstash-configurationerror-message-expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/255210 "2020-11-17T11:55:59Z")
Hi, I am facing a peculiar issue. I have seen the error faced by many before me, but the solution (only a few of them said resolved by fresh creation by typing the logstash.conf file) is not working for me. Please help… --- ## [Import and load HTML+Js in Kibana as a visualization panel](https://discuss.elastic.co/t/import-and-load-html-js-in-kibana-as-a-visualization-panel/50834)
**Author:** [@Meenal.Luktuke](https://discuss.elastic.co/u/Meenal.Luktuke)\ **Replies:** 7\ **Last updated:** [November 30, 2021, 5:03pm UTC](https://discuss.elastic.co/t/import-and-load-html-js-in-kibana-as-a-visualization-panel/50834 "2021-11-30T17:03:25Z")
Hi, I have created a JS+HTML package which interacts with Elasticsearch and displays data in the format I want. I just want to display it on my Kibana dashboard. It's okay if it does not interact with other panels, but… --- ## [Curator SSL Warning Suppression?](https://discuss.elastic.co/t/curator-ssl-warning-suppression/114174)
**Author:** [@timvisher](https://discuss.elastic.co/u/timvisher)\ **Replies:** 6\ **Last updated:** [January 5, 2018, 3:59pm UTC](https://discuss.elastic.co/t/curator-ssl-warning-suppression/114174 "2018-01-05T15:59:36Z")
I would like to suppress the urllib3 warnings about insecure SSL usage. However, none of the usual means work for me. even PYTHONWARNINGS=ignore which is more of a blanket statement than I'd like to make continues to all… --- ## [How to download a old version of es?](https://discuss.elastic.co/t/how-to-download-a-old-version-of-es/187466)
**Author:** [@9527q](https://discuss.elastic.co/u/9527q)\ **Replies:** 4\ **Last updated:** [June 26, 2019, 3:53am UTC](https://discuss.elastic.co/t/how-to-download-a-old-version-of-es/187466 "2019-06-26T03:53:35Z")
I want to download a es6.7, but I can't find the download-url. There is only a lasted version (7.2) of es. Of course I also want to know the method to find the all verision of every plugin. I'm from China and my English… --- ## [Difference between filebeat.modules and filebeat.prospectors](https://discuss.elastic.co/t/difference-between-filebeat-modules-and-filebeat-prospectors/90370)
**Author:** [@amarc](https://discuss.elastic.co/u/amarc)\ **Replies:** 7\ **Last updated:** [June 27, 2017, 8:40am UTC](https://discuss.elastic.co/t/difference-between-filebeat-modules-and-filebeat-prospectors/90370 "2017-06-27T08:40:08Z")
There are filebeat.modules for system, audit, apache etc. And same thing can be done using filebeat.prospectors with path: /var/log/messages etc. So what is the difference between using a module and using prospectors wit… --- ## [How to divide value by 1024 in scripted field](https://discuss.elastic.co/t/how-to-divide-value-by-1024-in-scripted-field/151568)
**Author:** [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Replies:** 7\ **Last updated:** [October 11, 2018, 9:04am UTC](https://discuss.elastic.co/t/how-to-divide-value-by-1024-in-scripted-field/151568 "2018-10-11T09:04:19Z")
Hi Guys, Can you help me, I'm trying to divide the field value to 1024 but it showed script invalid. Below are my codes, I'm using the scripted field. if(doc\['webpage\_size'\].value !=null) { return doc\['webpage\_size'… --- ## [At least one primary shard for the index \[.security-7\] is unavailable](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable/249508)
**Author:** [@naveenj](https://discuss.elastic.co/u/naveenj)\ **Replies:** 4\ **Last updated:** [September 28, 2020, 4:28am UTC](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable/249508 "2020-09-28T04:28:25Z")
Getting bellow error but elastic and kibana both working fine. Let me know the issue? org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index \[.security-7\] is unavailable at org.el… --- ## [Time incorrect from system module (syslog)](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 6\ **Last updated:** [March 1, 2018, 2:39pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905 "2018-03-01T14:39:03Z")
Beats and ES 6.2.2 When we enable the System module the time of syslog entries in Kibana shows as UTC appearing 5 hours old. The syslog entries themselves have the correct EST time. If we enable log watching in the fil… --- ## [Visualizing Sum of Two Fields](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427)
**Author:** [@xwang1](https://discuss.elastic.co/u/xwang1)\ **Replies:** 2\ **Last updated:** [June 14, 2017, 5:56pm UTC](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427 "2017-06-14T17:56:40Z")
I'm new to Kibana/Elasticsearch and I'm trying to visualize traffic data between servers. However my logstash indices only contain the fields "fwdbytes" (bytes sent out) and "bwdbytes" (bytes received). I am trying to vi… --- ## [Daily rollover with ILM](https://discuss.elastic.co/t/daily-rollover-with-ilm/188438)
**Author:** [@juanarmentia](https://discuss.elastic.co/u/juanarmentia)\ **Replies:** 7\ **Last updated:** [July 31, 2019, 2:20pm UTC](https://discuss.elastic.co/t/daily-rollover-with-ilm/188438 "2019-07-31T14:20:22Z")
Hi, I have an index named "winlogbeat-7.1.1-2019.07.02-000001" and I want to rollover every day. I have define a lifecycle policy for rolling when the index is bigger than 10GB, but I don't know how define the daily ro… --- ## [Startwith query not working if string has hyphen (-)](https://discuss.elastic.co/t/startwith-query-not-working-if-string-has-hyphen/120146)
**Author:** [@nmathur](https://discuss.elastic.co/u/nmathur)\ **Replies:** 4\ **Last updated:** [February 16, 2018, 4:14pm UTC](https://discuss.elastic.co/t/startwith-query-not-working-if-string-has-hyphen/120146 "2018-02-16T16:14:34Z")
Hello All, I am writing a query to fetch items using start with query ... the query returns nothing if the input string has hyphen. Below is working: {"query":{"bool":{"must":\[{"term":{"CompanyId":2}},{"query\_string":… --- ## [How to Look at Kibana Logs in Elastic Cloud?](https://discuss.elastic.co/t/how-to-look-at-kibana-logs-in-elastic-cloud/260564)
**Author:** [@Chris\_Carter1](https://discuss.elastic.co/u/Chris_Carter1)\ **Replies:** 3\ **Last updated:** [January 8, 2021, 10:02pm UTC](https://discuss.elastic.co/t/how-to-look-at-kibana-logs-in-elastic-cloud/260564 "2021-01-08T22:02:53Z")
We are wanting to audit and see which dashboards are used most frequently, I know there is not a direct feature to view how often dashboards are used but If I could look at the Logs in Kibana I could parse the logs and g… --- ## [Elasticsearch API not designed to be consumed directly by a front-end client?](https://discuss.elastic.co/t/elasticsearch-api-not-designed-to-be-consumed-directly-by-a-front-end-client/110546)
**Author:** [@bradley](https://discuss.elastic.co/u/bradley)\ **Replies:** 2\ **Last updated:** [December 8, 2017, 6:29am UTC](https://discuss.elastic.co/t/elasticsearch-api-not-designed-to-be-consumed-directly-by-a-front-end-client/110546 "2017-12-08T06:29:11Z")
It's possible, but not recommended. The Elasticsearch API is not designed to be consumed directly by a front end client, and the security constraints that are put in place within X-Pack do not aim to be secure within … --- ## [If conditions in Ruby code in Logstash](https://discuss.elastic.co/t/if-conditions-in-ruby-code-in-logstash/37274)
**Author:** [@Omer\_Uludag](https://discuss.elastic.co/u/Omer_Uludag)\ **Replies:** 2\ **Last updated:** [December 15, 2015, 7:29pm UTC](https://discuss.elastic.co/t/if-conditions-in-ruby-code-in-logstash/37274 "2015-12-15T19:29:07Z")
Hello together, I am new in the Elasticsearch Ecosystem. For that reason, I have unfortunately some problems with the syntax of Ruby in Logstash. I have the following snippet code: if \[Clat\] != '' { ruby { code… --- ## [Kibana Alert & Report App for Elasticsearch - KaaE](https://discuss.elastic.co/t/kibana-alert-report-app-for-elasticsearch-kaae/62329)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 0\ **Last updated:** [October 6, 2016, 4:30am UTC](https://discuss.elastic.co/t/kibana-alert-report-app-for-elasticsearch-kaae/62329 "2016-10-06T04:30:16Z")
Has anyone used this tool? I've installed it and although it's still somewhat buggy, the functionality is very impressive. For someone running a relatively small and cheap cluster, this is a lifesaver! If anyone has a… --- ## [Character limit in fields longer then 1024 (truncated with ellipsis)](https://discuss.elastic.co/t/character-limit-in-fields-longer-then-1024-truncated-with-ellipsis/280415)
**Author:** [@GiladanoN](https://discuss.elastic.co/u/GiladanoN)\ **Replies:** 4\ **Last updated:** [August 11, 2021, 2:03am UTC](https://discuss.elastic.co/t/character-limit-in-fields-longer-then-1024-truncated-with-ellipsis/280415 "2021-08-11T02:03:33Z")
Hi/ i'm having an issue with certain logs fields being longer than 1024 chars. When searching for the relevant log it comes up, but the relevant field is truncated, and the remainder of the text is replaced with an ell… --- ## [Deleting data and avoiding reindexing](https://discuss.elastic.co/t/deleting-data-and-avoiding-reindexing/82751)
**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\ **Replies:** 8\ **Last updated:** [April 18, 2017, 10:29pm UTC](https://discuss.elastic.co/t/deleting-data-and-avoiding-reindexing/82751 "2017-04-18T22:29:20Z")
I'm trying to figure out if elasticsearch will remove the segments of the data I delete on it's own or do I need to delete and reindex? Every week we are indexing millions of documents and every week indexing is becomi… --- ## [Getting filebeat to process JSON logs from osquery](https://discuss.elastic.co/t/getting-filebeat-to-process-json-logs-from-osquery/54779)
**Author:** [@shauvik](https://discuss.elastic.co/u/shauvik)\ **Replies:** 4\ **Last updated:** [July 18, 2016, 6:44pm UTC](https://discuss.elastic.co/t/getting-filebeat-to-process-json-logs-from-osquery/54779 "2016-07-18T18:44:28Z")
I'm trying to use filebeat instead of logstash to aggregate osquery logs but the logs seem to be loaded as plain text instead. Here are the instructions I am referring to: http://lowlyadmin.com/mac/2016/06/02/deploying… [Previous page](https://discuss.elastic.co/top.md?page=390&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=392&per_page=50&period=all)