# Top **URL:** https://discuss.elastic.co/top.md?page=392&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 393 --- ## [Can SAP Business Objects be used with Elastic Search](https://discuss.elastic.co/t/can-sap-business-objects-be-used-with-elastic-search/787)
**Author:** [@duplo](https://discuss.elastic.co/u/duplo)\ **Replies:** 6\ **Last updated:** [December 22, 2015, 7:20pm UTC](https://discuss.elastic.co/t/can-sap-business-objects-be-used-with-elastic-search/787 "2015-12-22T19:20:39Z")
Hello. I am not a techie so if this question is incredibly stupid, please forgive me. I am a management consultant and I have a client that has made the fundamental error of viewing BI as a tool and not a strategy. T… --- ## [Storing XML in Elastic Search without analyzing/indexing](https://discuss.elastic.co/t/storing-xml-in-elastic-search-without-analyzing-indexing/66857)
**Author:** [@jiouser](https://discuss.elastic.co/u/jiouser)\ **Replies:** 4\ **Last updated:** [November 23, 2016, 8:13am UTC](https://discuss.elastic.co/t/storing-xml-in-elastic-search-without-analyzing-indexing/66857 "2016-11-23T08:13:41Z")
I need to store the XML document and some information pertaining to this in ES. Basically I dont want the XML to be analyzed/indexed. The additional information for the XML will be stored in the field. When the query is … --- ## [Efficiency of search vs get](https://discuss.elastic.co/t/efficiency-of-search-vs-get/5389)
**Author:** [@Steff](https://discuss.elastic.co/u/Steff)\ **Replies:** 5\ **Last updated:** [July 28, 2014, 12:16pm UTC](https://discuss.elastic.co/t/efficiency-of-search-vs-get/5389 "2014-07-28T12:16:16Z")
curl -X PUT "localhost:9200/mytest/abc/\_mapping" -d '{ "abc" : { "\_routing" : { "required" : true } "properties" : { "idx" : {"type" : "string", "index" : "not\_analyzed"}, "a" : {"type" : "string"}… --- ## [Exactly - how to map geoip.location to geo\_point- WTF!](https://discuss.elastic.co/t/exactly-how-to-map-geoip-location-to-geo-point-wtf/68812)
**Author:** [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\ **Replies:** 5\ **Last updated:** [December 13, 2016, 5:20am UTC](https://discuss.elastic.co/t/exactly-how-to-map-geoip-location-to-geo-point-wtf/68812 "2016-12-13T05:20:44Z")
Folks - I'm at a complete loss here. I've scoured the web trying to find out how to do this and this just seems unnecessarily complicated. Can someone point me to a working example of what is needed to map my data to g… --- ## [Bitwise operator](https://discuss.elastic.co/t/bitwise-operator/4488)
**Author:** [@George\_3](https://discuss.elastic.co/u/George_3)\ **Replies:** 4\ **Last updated:** [May 27, 2011, 11:45am UTC](https://discuss.elastic.co/t/bitwise-operator/4488 "2011-05-27T11:45:28Z")
Hi Shay, First of all thank you for elasticsearch. Is there a way where I can use bitwise operator on integer field to filter a search query based on group membership where each group is assigned to a bit in an i… --- ## [Elasticsearch is down. What happens to output data from Logstash?](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 7\ **Last updated:** [April 22, 2016, 8:02pm UTC](https://discuss.elastic.co/t/elasticsearch-is-down-what-happens-to-output-data-from-logstash/23774 "2016-04-22T20:02:44Z")
Hi, This probably is a repeated question. But I would like to clarify this. Elasticsearch is down suddenly on central server. But Logstash is running on remote server parsing logs. We started elasticsearch after few … --- ## [Need Help --- How to Handle "org.elasticsearch.transport.ConnectTransportException" in Java Application](https://discuss.elastic.co/t/need-help-how-to-handle-org-elasticsearch-transport-connecttransportexception-in-java-application/13102)
**Author:** [@mohammad\_rafi\_g](https://discuss.elastic.co/u/mohammad_rafi_g)\ **Replies:** 2\ **Last updated:** [August 7, 2013, 9:13am UTC](https://discuss.elastic.co/t/need-help-how-to-handle-org-elasticsearch-transport-connecttransportexception-in-java-application/13102 "2013-08-07T09:13:11Z")
Hi to All, We have 4 nodes\[1 Master Node+1 client Node + 2 Data Nodes\] and the settings of each node is: each node heap size is 5gb\["ES\_MIN\_MEM" and "ES\_MAX\_MEM" are 5gb\] and… --- ## [Snort Logs with FileBeat](https://discuss.elastic.co/t/snort-logs-with-filebeat/177879)
**Author:** [@johndowe](https://discuss.elastic.co/u/johndowe)\ **Replies:** 4\ **Last updated:** [April 30, 2019, 9:20pm UTC](https://discuss.elastic.co/t/snort-logs-with-filebeat/177879 "2019-04-30T21:20:29Z")
Hi, I have setup filebeat on a pi running Snort sending logs to a cloud ELK stack. I am trying to figure out how to arrange logs and doing the following process: on the beats side i have this in the filebeat.yml: path… --- ## [Kibana shows Shard Failures](https://discuss.elastic.co/t/kibana-shows-shard-failures/37779)
**Author:** [@ananthanaidu](https://discuss.elastic.co/u/ananthanaidu)\ **Replies:** 6\ **Last updated:** [June 6, 2016, 8:21am UTC](https://discuss.elastic.co/t/kibana-shows-shard-failures/37779 "2016-06-06T08:21:24Z")
HI Greetings, Can you please help to fix below kibana error, Shard Failures Index: weblogs-2015.12.07 Shard: 0 Reason: ElasticsearchException\[org.elasticsearch.common.breaker.CircuitBreakingException: \[FIELDDATA\] D… --- ## [Sandbox for painless?](https://discuss.elastic.co/t/sandbox-for-painless/103405)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 2\ **Last updated:** [October 10, 2017, 6:59pm UTC](https://discuss.elastic.co/t/sandbox-for-painless/103405 "2017-10-10T18:59:31Z")
Is there any site or method to make sandbox with Painless? Can I test the scripts as if it were the javascript language? How can I test my scripts? For example in some functions I wondered if the value is correct. bo… --- ## [Cannot create pipeline](https://discuss.elastic.co/t/cannot-create-pipeline/97062)
**Author:** [@syashwanthk](https://discuss.elastic.co/u/syashwanthk)\ **Replies:** 8\ **Last updated:** [August 15, 2017, 11:46am UTC](https://discuss.elastic.co/t/cannot-create-pipeline/97062 "2017-08-15T11:46:49Z")
Hi, logstash -e ‘input { stdin{} } output { elasticsearch{ host =\>“localhost:9200” } }’ Please find the complete logs as below while trying to configure logstash: \[2017-08-15T12:03:17,000\]\[DEBUG\]\[logstash.plugins.regi… --- ## [How get the document field when disable the \_source?](https://discuss.elastic.co/t/how-get-the-document-field-when-disable-the--source/26941)
**Author:** [@gin](https://discuss.elastic.co/u/gin)\ **Replies:** 4\ **Last updated:** [August 12, 2015, 2:11am UTC](https://discuss.elastic.co/t/how-get-the-document-field-when-disable-the--source/26941 "2015-08-12T02:11:31Z")
Hi, I'm trying to disable \_source as in my case the updated and reindex are unnecessary feature. The issue is I cannot get any field when the \_source is diabled. I created a index like: curl -XPUT http://localh… --- ## [\[BUG?\] Cookies are invalidated after some time](https://discuss.elastic.co/t/bug-cookies-are-invalidated-after-some-time/34252)
**Author:** [@WoJ](https://discuss.elastic.co/u/WoJ)\ **Replies:** 6\ **Last updated:** [December 18, 2015, 5:27pm UTC](https://discuss.elastic.co/t/bug-cookies-are-invalidated-after-some-time/34252 "2015-12-18T17:27:48Z")
Scenario: cookies on the browser are cleared Kibana is accessed no activity with kibana for some time any new request to kibana from the same browser yields the message {"statusCode":400,"error":"Bad Request","message… --- ## [What Would be the filetype for our custom patterns in ./pattern directory](https://discuss.elastic.co/t/what-would-be-the-filetype-for-our-custom-patterns-in-pattern-directory/88029)
**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\ **Replies:** 8\ **Last updated:** [June 16, 2017, 7:22am UTC](https://discuss.elastic.co/t/what-would-be-the-filetype-for-our-custom-patterns-in-pattern-directory/88029 "2017-06-16T07:22:23Z")
Hi guys, i read document of logstash where document said you can define your custom pattern in ./pattern directory. but when i download latest logstash then There is not any ./pattern directory available in logstas… --- ## ["object mapping for \[monitor\] tried to parse field \[monitor\] as object, but found a concrete value"](https://discuss.elastic.co/t/object-mapping-for-monitor-tried-to-parse-field-monitor-as-object-but-found-a-concrete-value/137806)
**Author:** [@hollowimage](https://discuss.elastic.co/u/hollowimage)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 11:30pm UTC](https://discuss.elastic.co/t/object-mapping-for-monitor-tried-to-parse-field-monitor-as-object-but-found-a-concrete-value/137806 "2018-06-28T23:30:06Z")
I am using heartbeat 6.2.2, logstash 6.2.3, elasticsearch 6.2.3 When sending heartbeat tcp monitor data to logstash, i get the following error message: \[2018-06-28T00:57:22,253\]\[WARN \]\[logstash.outputs.elasticsearch\] C… --- ## [Logstash appends port 9200 to Elasticsearch URL](https://discuss.elastic.co/t/logstash-appends-port-9200-to-elasticsearch-url/161154)
**Author:** [@patrick007](https://discuss.elastic.co/u/patrick007)\ **Replies:** 4\ **Last updated:** [December 17, 2018, 2:38pm UTC](https://discuss.elastic.co/t/logstash-appends-port-9200-to-elasticsearch-url/161154 "2018-12-17T14:38:25Z")
I am using AWS elasticsearch service , which return me a URL for Elasticsearch. Example : https:// www.es-aws.com // ES Url When I try to use the URL in logstash, it tries to connect https:// www.es-aws.com:9200 inst… --- ## [Caught error spawning Chromium - Generate PDF Error](https://discuss.elastic.co/t/caught-error-spawning-chromium-generate-pdf-error/160390)
**Author:** [@avais](https://discuss.elastic.co/u/avais)\ **Replies:** 5\ **Last updated:** [January 9, 2019, 7:20am UTC](https://discuss.elastic.co/t/caught-error-spawning-chromium-generate-pdf-error/160390 "2019-01-09T07:20:07Z")
Hi Community, Kibana version : 6.5.1 hosted in docker container (the whole stack is in docker container) When I am trying to 'generate pdf' from 'share' option in dashboard : I am getting the following error : Ve… --- ## [How do i cancel an ongoing reindex operation?](https://discuss.elastic.co/t/how-do-i-cancel-an-ongoing-reindex-operation/155383)
**Author:** [@jacobot](https://discuss.elastic.co/u/jacobot)\ **Replies:** 6\ **Last updated:** [November 5, 2018, 12:11pm UTC](https://discuss.elastic.co/t/how-do-i-cancel-an-ongoing-reindex-operation/155383 "2018-11-05T12:11:37Z")
How do i cancel an ongoing re-index operation? I am reindexing it seems 118million documents (at 5000 doc/sec) this would take 6 hours in hindsight How can i cancel this operation? Cheers Jacob --- ## [Multiple elasticsearch support within one kibana instance](https://discuss.elastic.co/t/multiple-elasticsearch-support-within-one-kibana-instance/114980)
**Author:** [@prabhu\_pandurangan](https://discuss.elastic.co/u/prabhu_pandurangan)\ **Replies:** 2\ **Last updated:** [January 12, 2018, 10:58pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-support-within-one-kibana-instance/114980 "2018-01-12T22:58:18Z")
Hi Team, I would like to have 2 elasticsearch instance and would like to access it from within kibana based on need. Elasticsearch instance can be on cluster setup. I believe there is something like 'tribe' node setup… --- ## [Kibana Dashboard shows Config: Error 400 Bad Request: undefined](https://discuss.elastic.co/t/kibana-dashboard-shows-config-error-400-bad-request-undefined/86340)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 6\ **Last updated:** [May 19, 2017, 10:31pm UTC](https://discuss.elastic.co/t/kibana-dashboard-shows-config-error-400-bad-request-undefined/86340 "2017-05-19T22:31:20Z")
I'm worried where is my configuration is wrong. Everything looks working fine but when I open the browser is see "Config: Error 400 Bad Request: undefined". FYI I'm using the latest version 5.4.0. --- ## [Parsing multiple files with Filebeat](https://discuss.elastic.co/t/parsing-multiple-files-with-filebeat/271591)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 8\ **Last updated:** [April 30, 2021, 1:20am UTC](https://discuss.elastic.co/t/parsing-multiple-files-with-filebeat/271591 "2021-04-30T01:20:29Z")
Dear all, I have several JSON files that I wish to parse with Filebeat; and I read the following: https://stackoverflow.com/questions/39983918/can-filebeat-use-multiple-config-files I used the code in the above soluti… --- ## [How to Monitor particular process and file system disk space through metricbeat](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909)
**Author:** [@udareddy](https://discuss.elastic.co/u/udareddy)\ **Replies:** 3\ **Last updated:** [November 1, 2017, 7:33pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909 "2017-11-01T19:33:48Z")
Hi All, I am happy that we have very good forum to discuss and help each other on ELK stack, and am very new to ELK stack integrations but I have good knowledge on Splunk integration. I am seeking help on below requir… --- ## [Json filter and removing json fields](https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556)
**Author:** [@quietrags](https://discuss.elastic.co/u/quietrags)\ **Replies:** 1\ **Last updated:** [June 13, 2016, 8:43am UTC](https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556 "2016-06-13T08:43:42Z")
I am using the json filter in my logstash processing and i would like to remove some of the json fields that get parsed. I am unable to figure out what the format should be. Here is my json { "cookies" : {"x" : 1, "mo… --- ## [The age of index which is using ilm policy management](https://discuss.elastic.co/t/the-age-of-index-which-is-using-ilm-policy-management/261198)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 7\ **Last updated:** [January 16, 2021, 9:42am UTC](https://discuss.elastic.co/t/the-age-of-index-which-is-using-ilm-policy-management/261198 "2021-01-16T09:42:03Z")
Hello, I'm currently trying to configure and using ilm lifecycle management and data stream for my indices,we are metting a question,when the index was rollovered,the age of index will be reset,this got us into trouble.… --- ## [Canvas if ... or logic](https://discuss.elastic.co/t/canvas-if-or-logic/193843)
**Author:** [@fpunzo](https://discuss.elastic.co/u/fpunzo)\ **Replies:** 1\ **Last updated:** [August 5, 2019, 7:11pm UTC](https://discuss.elastic.co/t/canvas-if-or-logic/193843 "2019-08-05T19:11:35Z")
Hi I am trying to create a RAG (red, amber green) indicator that is based on the results of a query. I am on Kibana Version 6.8.1. I'm trying to add and "OR" condition within an "IF" statement. I am getting the following… --- ## [MapperParsingException\[Failed to parse mapping...\]](https://discuss.elastic.co/t/mapperparsingexception-failed-to-parse-mapping/89978)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 4\ **Last updated:** [June 20, 2017, 6:19am UTC](https://discuss.elastic.co/t/mapperparsingexception-failed-to-parse-mapping/89978 "2017-06-20T06:19:59Z")
I keep getting the following exception while creating index using API. This does not happen in all cases. {"message":"Elasticsearch exception: MapperParsingException\[Failed to parse mapping \[records\]: name cannot be e… --- ## [How to get the case insensitive results from a regex query](https://discuss.elastic.co/t/how-to-get-the-case-insensitive-results-from-a-regex-query/60199)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 3\ **Last updated:** [September 13, 2016, 11:23am UTC](https://discuss.elastic.co/t/how-to-get-the-case-insensitive-results-from-a-regex-query/60199 "2016-09-13T11:23:30Z")
Hi, i am currently using the below query, is there a way i can get case insensitive results out of this? all my fields are "not\_analyzed". please help. { "query" : { "bool" : { "must" : \[ { "range… --- ## [Newly installed metricbeat=\>logstash 6.0.0 Error (BeatsParser InvalidFrameProtocolException: Invalid Frame Type)](https://discuss.elastic.co/t/newly-installed-metricbeat-logstash-6-0-0-error-beatsparser-invalidframeprotocolexception-invalid-frame-type/115147)
**Author:** [@jamesliu\_london](https://discuss.elastic.co/u/jamesliu_london)\ **Replies:** 4\ **Last updated:** [January 11, 2018, 6:15pm UTC](https://discuss.elastic.co/t/newly-installed-metricbeat-logstash-6-0-0-error-beatsparser-invalidframeprotocolexception-invalid-frame-type/115147 "2018-01-11T18:15:19Z")
When connecting metricbeats to logstash, I'm metricbeats is unable to connect: "Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received" We have EL5.6+Xpack , Kib5.6 +Xpack… --- ## [Filebeat with multiline vs. multiline logstash codec](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 7\ **Last updated:** [May 12, 2017, 7:28am UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808 "2017-05-12T07:28:42Z")
I've seen some talk of a multiline option in filebeat but I'm in the process of setting up filebeat sending to logstash via beats input and need to parse multiline logs. Can I use the multiline codec in the input section… --- ## [Extract information from raw messages in KIBANA](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820)
**Author:** [@tofmonaute](https://discuss.elastic.co/u/tofmonaute)\ **Replies:** 2\ **Last updated:** [December 24, 2019, 3:07am UTC](https://discuss.elastic.co/t/extract-information-from-raw-messages-in-kibana/212820 "2019-12-24T03:07:43Z")
Hi, I've been struggling for weeks to create a vizualization with dynamic labels : extracted from a a search request. ( we dont want to create a new field in logstash for some errors that occurs with a very l… --- ## [How to parse json in grok](https://discuss.elastic.co/t/how-to-parse-json-in-grok/129465)
**Author:** [@jimmy.zhao](https://discuss.elastic.co/u/jimmy.zhao)\ **Replies:** 2\ **Last updated:** [April 26, 2018, 1:54am UTC](https://discuss.elastic.co/t/how-to-parse-json-in-grok/129465 "2018-04-26T01:54:50Z")
I was trying to parse my Neutron log through grok pattern, the last two fileds are two json string, here is the line. 2018-04-19T05:08:42.833+02:00 localhost neutron-api INFO \[type:operate\] \[pid:2157\] \[MainThread\] \[acce… --- ## [How to deploy elasticsearch engine as a WAR file into Tomcat server?](https://discuss.elastic.co/t/how-to-deploy-elasticsearch-engine-as-a-war-file-into-tomcat-server/29977)
**Author:** [@coolkbcs](https://discuss.elastic.co/u/coolkbcs)\ **Replies:** 3\ **Last updated:** [November 27, 2015, 1:03pm UTC](https://discuss.elastic.co/t/how-to-deploy-elasticsearch-engine-as-a-war-file-into-tomcat-server/29977 "2015-11-27T13:03:13Z")
I want to run elastic search engine through tomcat cat server. How I can achieve this, Please help. Thanks Kul --- ## [DNS filter not working](https://discuss.elastic.co/t/dns-filter-not-working/77315)
**Author:** [@nigdav007](https://discuss.elastic.co/u/nigdav007)\ **Replies:** 4\ **Last updated:** [March 31, 2017, 1:29pm UTC](https://discuss.elastic.co/t/dns-filter-not-working/77315 "2017-03-31T13:29:42Z")
Hay all I am an tad stuck with the DNS filter. My issue all my syslogs hosts are coming up with the ip address and not the hostname. I like to use the DNS filter to get the hostname, but for some reason its not worki… --- ## [緯度経度をkibanaの世界地図にマッピングする方法について](https://discuss.elastic.co/t/kibana/155867)
**Author:** [@TK1](https://discuss.elastic.co/u/TK1)\ **Replies:** 3\ **Last updated:** [November 14, 2018, 3:53am UTC](https://discuss.elastic.co/t/kibana/155867 "2018-11-14T03:53:49Z")
csvファイルの緯度経度の情報からkibanaで世界地図上に可視化したいのですが上手くいきません． logstashのconfファイルをどのように改善すればよいかアドバイスもらえませんか． http://onthesoup.hatenablog.com/entry/2018/02/11/061500 上記のサイトを参考にしているのですが，ipアドレスからelasticsearchに入力する際にgeoipを入力するのでは処理に時間が… --- ## [Index data size is too big](https://discuss.elastic.co/t/index-data-size-is-too-big/101140)
**Author:** [@w11th](https://discuss.elastic.co/u/w11th)\ **Replies:** 4\ **Last updated:** [September 20, 2017, 11:28am UTC](https://discuss.elastic.co/t/index-data-size-is-too-big/101140 "2017-09-20T11:28:28Z")
\[55\] I deploy an ELK system on Ubuntu, use Filebeat to collect logs. But the index size is too huge. I can't figure out why... This is my Logstash setting: input { beats { port =\> 8903 } } output { elasti… --- ## [Remove ignore\_above default mapping](https://discuss.elastic.co/t/remove-ignore-above-default-mapping/85024)
**Author:** [@elk\_user1](https://discuss.elastic.co/u/elk_user1)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 10:40am UTC](https://discuss.elastic.co/t/remove-ignore-above-default-mapping/85024 "2017-05-09T10:40:40Z")
Hello, So I have defined a mapping for an index before loading the data. So based on that (I guess), any new text fields coming are considered as text/keyword fields but with additional property of ignore\_above:256. Ho… --- ## [Watcher Send to Multiple Emails Action](https://discuss.elastic.co/t/watcher-send-to-multiple-emails-action/61736)
**Author:** [@mmbtenorio](https://discuss.elastic.co/u/mmbtenorio)\ **Replies:** 5\ **Last updated:** [September 30, 2016, 5:53pm UTC](https://discuss.elastic.co/t/watcher-send-to-multiple-emails-action/61736 "2016-09-30T17:53:46Z")
Hello! I have a problem regarding sending to multiple emails. The watch can be put to the elasticsearch, but once you execute it, the email action will report an error: { "id": "email\_admin", "type": "… --- ## [Correct Grok Pattern for an optional field including spaces](https://discuss.elastic.co/t/correct-grok-pattern-for-an-optional-field-including-spaces/188571)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 5\ **Last updated:** [July 4, 2019, 3:18pm UTC](https://discuss.elastic.co/t/correct-grok-pattern-for-an-optional-field-including-spaces/188571 "2019-07-04T15:18:11Z")
In some of the log messages, an optional field \[opt\_field=xyz\] or \[opt\_field=\] is present. I arrived at the following pattern to handle it: (?m)%{TIMESTAMP\_ISO8601:Src\_CreateDate} %{LOGLEVEL:Src\_Severity} \\\[(?\ **Author:** [@Jingang\_Wang](https://discuss.elastic.co/u/Jingang_Wang)\ **Replies:** 5\ **Last updated:** [April 2, 2013, 10:02am UTC](https://discuss.elastic.co/t/how-to-construct-a-boolquery-dynamically-in-java-api/11396 "2013-04-02T10:02:45Z") Hi there, In my program, I generated a list of termQuery dynamically and I want to combine them into a boolquery. How could I implement it in java api? Thanks. By the way, I want to accomplish the fuction as follow… --- ## [Filebeat multiline pattern for date format 'not working'!](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-date-format-not-working/138585)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 7\ **Last updated:** [July 5, 2018, 3:23pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-date-format-not-working/138585 "2018-07-05T15:23:36Z")
Hi Guys, I have a problem with my multiline pattern in filebeat, my date format for Log-file p\_icn looks like \[6/13/18 8:11:25:022 CEST\] and I used these patterns '^\\\[\[0-9\]{1}/\[0-9\]{2}/\[0-9\]{2}' but it does not parset a… --- ## [Skipping action "delete\_indices" due to empty list! Curator](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118)
**Author:** [@saisimo02](https://discuss.elastic.co/u/saisimo02)\ **Replies:** 6\ **Last updated:** [August 20, 2018, 2:20pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118 "2018-08-20T14:20:20Z")
Hello, I wanna delete the older data from elasticsearch, I used curator for that: curator.yml client: hosts: - 127.0.0.1 port: 9200 url\_prefix: use\_ssl: False certificate: client\_cert: client\_key: … --- ## [Kibana login does not work](https://discuss.elastic.co/t/kibana-login-does-not-work/188198)
**Author:** [@dumkaz](https://discuss.elastic.co/u/dumkaz)\ **Replies:** 4\ **Last updated:** [July 1, 2019, 1:09pm UTC](https://discuss.elastic.co/t/kibana-login-does-not-work/188198 "2019-07-01T13:09:05Z")
I have enabled inter-node TLS communication and xpack security as described here: I have set passwords for elastic, kibana and all other users with Blockquote elasticsearch-setup-passwords interactive Blockquote i… --- ## [Running as a Service on Windows](https://discuss.elastic.co/t/running-as-a-service-on-windows/69938)
**Author:** [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\ **Replies:** 4\ **Last updated:** [December 27, 2016, 7:09am UTC](https://discuss.elastic.co/t/running-as-a-service-on-windows/69938 "2016-12-27T07:09:08Z")
I am running Elastic 5.1.1 and I am trying to run it as a service on Windows 10. Did a: elasticsearch-service.bat install Which was ok: Installing service : "elasticsearch-service-x64" Using JAVA\_HOME (64-bit):… --- ## [SERVICE\_UNAVAILABLE/2/no master](https://discuss.elastic.co/t/service-unavailable-2-no-master/316076)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 7\ **Last updated:** [October 13, 2022, 3:33pm UTC](https://discuss.elastic.co/t/service-unavailable-2-no-master/316076 "2022-10-13T15:33:39Z")
Hi, I am new to Elasticsearch and need your help to understad the issue. Here is my elasticsearch.yml ======================== Elasticsearch Configuration ========================= cluster.name: ELKcluster node.name: … --- ## [Is it possible to filter in Kibana based on fields not rendered in a visualisation?](https://discuss.elastic.co/t/is-it-possible-to-filter-in-kibana-based-on-fields-not-rendered-in-a-visualisation/50256)
**Author:** [@daniel-burke](https://discuss.elastic.co/u/daniel-burke)\ **Replies:** 8\ **Last updated:** [December 15, 2016, 5:25pm UTC](https://discuss.elastic.co/t/is-it-possible-to-filter-in-kibana-based-on-fields-not-rendered-in-a-visualisation/50256 "2016-12-15T17:25:30Z")
This is probably easier to describe using an example. If I have records like: User { "username" : "xxxxxx", "user\_id" : "12345" } When I render a visualisation based on username I can click on one of the usernam… --- ## [Filter Error ASCII-8BIT to UTF-8](https://discuss.elastic.co/t/filter-error-ascii-8bit-to-utf-8/124156)
**Author:** [@Kareny](https://discuss.elastic.co/u/Kareny)\ **Replies:** 3\ **Last updated:** [April 5, 2018, 10:22pm UTC](https://discuss.elastic.co/t/filter-error-ascii-8bit-to-utf-8/124156 "2018-04-05T22:22:50Z")
Hi, I got the following error when running the logstash with jdbc plugin to fetch logs from a oracle database. Mar 13 17:09:31 exabeamlms01 docker\[10496\]: \[2018-03-13T17:09:31,010\]\[ERROR\] \[logstash.filters.ruby \] Ruby… --- ## [Too many open files exception even after raising the open file limit](https://discuss.elastic.co/t/too-many-open-files-exception-even-after-raising-the-open-file-limit/4492)
**Author:** [@Lucas\_Ward](https://discuss.elastic.co/u/Lucas_Ward)\ **Replies:** 6\ **Last updated:** [February 28, 2013, 12:22pm UTC](https://discuss.elastic.co/t/too-many-open-files-exception-even-after-raising-the-open-file-limit/4492 "2013-02-28T12:22:51Z")
All, I'm aware of the known issue with the limit of file descriptors, so when I first got this issue I upped the limit. I kept getting the exception, so I kept upping it. As an example, here is what ulimit -a ret… --- ## [Logstash Syslog,UDP listener died](https://discuss.elastic.co/t/logstash-syslog-udp-listener-died/34183)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 5\ **Last updated:** [November 11, 2015, 10:09pm UTC](https://discuss.elastic.co/t/logstash-syslog-udp-listener-died/34183 "2015-11-11T22:09:14Z")
elasticsearch=1.6 logstash=1.5 Im using docker with supervisord to start up the ELK stack. I tried using ort 514 and port 5009 to listen on the syslog messages coming in but when i run logstash in debug mode i get the … --- ## [Dec 3rd, 2018: \[KR\]\[Logstash\] Facebook 그룹의 글을 Elasticsearch 로 가져오기](https://discuss.elastic.co/t/dec-3rd-2018-kr-logstash-facebook-elasticsearch/158977)
**Author:** [@kimjmin](https://discuss.elastic.co/u/kimjmin)\ **Replies:** 0\ **Last updated:** [December 3, 2018, 8:00am UTC](https://discuss.elastic.co/t/dec-3rd-2018-kr-logstash-facebook-elasticsearch/158977 "2018-12-03T08:00:14Z")
내가 개발할 웹 애플리케이션 또는 모바일 앱 등에서 Facebook에 있는 피드나 기타 정보들을 가져오려면 아래의 Facebook 개발자 사이트에서 Facebook 개발자 앱을 등록해야 합니다. https://developers.facebook.com 앱을 생성하고 나면 필요한 여러가지 설정을 해 주어야 합니다. 저는 Elastic 한국 사용자 그룹의 글을 가져오기 위해서 만… --- ## [Filebeat 6.4.2 and 6.5.1: Read line error: "parsing CRI timestamp" and "invalid CRI log format"](https://discuss.elastic.co/t/filebeat-6-4-2-and-6-5-1-read-line-error-parsing-cri-timestamp-and-invalid-cri-log-format/159383)
**Author:** [@rocketraman](https://discuss.elastic.co/u/rocketraman)\ **Replies:** 8\ **Last updated:** [January 16, 2019, 11:24pm UTC](https://discuss.elastic.co/t/filebeat-6-4-2-and-6-5-1-read-line-error-parsing-cri-timestamp-and-invalid-cri-log-format/159383 "2019-01-16T23:24:34Z")
I am getting various CRI parsing errors, on both Filebeat 6.4.2 and 6.5.1. I have cleared all filebeat state and restarted Filebeat, but these errors always occur. Here are a couple: 2018-12-04T02:32:18.636Z ERROR log/h… [Previous page](https://discuss.elastic.co/top.md?page=391&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=393&per_page=50&period=all)