# Top **URL:** https://discuss.elastic.co/top.md?page=396&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 397 --- ## [Authentication using apikey failed](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066)
**Author:** [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Replies:** 6\ **Last updated:** [June 14, 2021, 1:27pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066 "2021-06-14T13:27:15Z")
So I recently had to reset my ELK stack, because I was having crazy issues I couldn't fix. Without realizing it, and after looking at the logs, I saw that also killed all of my api keys. \[2021-05-14T20:39:26,217\]\[WARN \]… --- ## [Kibana server is not ready yet with kibana docker](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-with-kibana-docker/285460)
**Author:** [@tikamafia](https://discuss.elastic.co/u/tikamafia)\ **Replies:** 4\ **Last updated:** [September 30, 2021, 3:00am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-with-kibana-docker/285460 "2021-09-30T03:00:47Z")
i had the problem "Kibana server is not ready yet" following the official guide. Here is information of my install process: docker compose up: version: '2' services: elasticsearch: container\_name: es01 imag… --- ## [Elastic Stack 7.11.0 Security Update](https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 4:55pm UTC](https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835 "2021-03-01T16:55:42Z")
Elasticsearch field disclosure flaw (ESA-2021-05) A document disclosure flaw was found in Elasticsearch when Document or Field Level Security is used. Get requests do not properly apply security permissions when executi… --- ## [Could Filebeat use UDP to send data to logstash?](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527)
**Author:** [@vermouth0064](https://discuss.elastic.co/u/vermouth0064)\ **Replies:** 5\ **Last updated:** [January 4, 2018, 1:09pm UTC](https://discuss.elastic.co/t/could-filebeat-use-udp-to-send-data-to-logstash/113527 "2018-01-04T13:09:04Z")
My boss argues that the TCP protocol in filebeat increases too many connections that will fill the connection pool and block other processes, so he advised us to use UDP. My question is whether he is correct and whether … --- ## [Elastic Search Partial Search](https://discuss.elastic.co/t/elastic-search-partial-search/155318)
**Author:** [@Nush](https://discuss.elastic.co/u/Nush)\ **Replies:** 7\ **Last updated:** [November 5, 2018, 9:39pm UTC](https://discuss.elastic.co/t/elastic-search-partial-search/155318 "2018-11-05T21:39:36Z")
Hey, I am trying to create a partial search with elasticsearch but it's not working then I expected. But full word its work fine. $esQuery = \[ 'index' =\> $category, 'type' =\> $category, 'body' =\> \[ "from" =\> ($… --- ## [Non-compliant license](https://discuss.elastic.co/t/non-compliant-license/41352)
**Author:** [@kawika](https://discuss.elastic.co/u/kawika)\ **Replies:** 7\ **Last updated:** [February 10, 2016, 5:36pm UTC](https://discuss.elastic.co/t/non-compliant-license/41352 "2016-02-10T17:36:24Z")
I installed the watcher but it tells me I have a non-compliant license. I have a basic license for Marvel so not sure if that conflicts or not. Need instructions to get the 30-day trial license for watcher. Thanks. --- ## [How to apply filters in time series visualize builder?](https://discuss.elastic.co/t/how-to-apply-filters-in-time-series-visualize-builder/134530)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 6\ **Last updated:** [June 6, 2018, 1:21pm UTC](https://discuss.elastic.co/t/how-to-apply-filters-in-time-series-visualize-builder/134530 "2018-06-06T13:21:59Z")
Hi How should I apply filters in visualize Builder? I've applied filter in discover tab and set Ignore global filters: No. Is there anything more that I should do. I've gone through the forum and found This issue was … --- ## [Grok filter confusion - Am I missing something?](https://discuss.elastic.co/t/grok-filter-confusion-am-i-missing-something/35461)
**Author:** [@plonka2000](https://discuss.elastic.co/u/plonka2000)\ **Replies:** 8\ **Last updated:** [November 25, 2015, 9:00am UTC](https://discuss.elastic.co/t/grok-filter-confusion-am-i-missing-something/35461 "2015-11-25T09:00:36Z")
Hi, I've been wresting with getting a grok filter to separate the "message" field to some new fields, so I can use them in Kibana. I understand that this should be a fairly straightforward process, when using the correc… --- ## [Filebeat conditional on annotation](https://discuss.elastic.co/t/filebeat-conditional-on-annotation/119786)
**Author:** [@Jim\_Sheldon](https://discuss.elastic.co/u/Jim_Sheldon)\ **Replies:** 8\ **Last updated:** [February 15, 2018, 3:42pm UTC](https://discuss.elastic.co/t/filebeat-conditional-on-annotation/119786 "2018-02-15T15:42:05Z")
Greetings! I am having trouble using a kubernetes pod annotation in a filebeat autodiscover conditional. I see that metricbeat's autodiscover kubernetes example has include\_annotations then a condition that looks at an… --- ## [I have to concatenate below two fields](https://discuss.elastic.co/t/i-have-to-concatenate-below-two-fields/177228)
**Author:** [@hemantkhokhar](https://discuss.elastic.co/u/hemantkhokhar)\ **Replies:** 2\ **Last updated:** [April 19, 2019, 9:49am UTC](https://discuss.elastic.co/t/i-have-to-concatenate-below-two-fields/177228 "2019-04-19T09:49:05Z")
%{URIPATH:url}%{DATA:\[status\]} I am using this but not success add\_field =\> \["%{DATA:actual-url}", "%{URIPATH:url} %{DATA:\[status\]}"\] --- ## [LSA, pLSA, LDA and elasticsearch](https://discuss.elastic.co/t/lsa-plsa-lda-and-elasticsearch/12997)
**Author:** [@Marco\_Fago](https://discuss.elastic.co/u/Marco_Fago)\ **Replies:** 6\ **Last updated:** [July 31, 2013, 8:38am UTC](https://discuss.elastic.co/t/lsa-plsa-lda-and-elasticsearch/12997 "2013-07-31T08:38:30Z")
Hi All, I'm new of elasticsearch and some indexing techniques, but I'm very interested in LSA,pLSA and LDA. Basically I have no idea of how to start implementing one of them in elasticsearch and what I should loo… --- ## [Error with Security Rules](https://discuss.elastic.co/t/error-with-security-rules/303960)
**Author:** [@efadeev](https://discuss.elastic.co/u/efadeev)\ **Replies:** 8\ **Last updated:** [May 23, 2022, 8:58pm UTC](https://discuss.elastic.co/t/error-with-security-rules/303960 "2022-05-23T20:58:58Z")
I got an error with Security Rules in my Kibana. Both custom and pre-built rules. " An error occurred when reading the rule. Unauthorized to get a "siem.queryRule" rule for "siem"" Rules added under elastic user --- ## [How to visualize Event Distribution by Daytime?](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317)
**Author:** [@Kevin\_Wiegand](https://discuss.elastic.co/u/Kevin_Wiegand)\ **Replies:** 5\ **Last updated:** [August 18, 2017, 9:27am UTC](https://discuss.elastic.co/t/how-to-visualize-event-distribution-by-daytime/97317 "2017-08-18T09:27:28Z")
I hope I’m able to describe my problem… i’m monitoring a system where students can login to register for exams. Now it would be interesting to do a visualisation which show at which daytime how many students try to logi… --- ## [Cluster Health (3 unassigned shards)](https://discuss.elastic.co/t/cluster-health-3-unassigned-shards/84700)
**Author:** [@michaeldtaylor](https://discuss.elastic.co/u/michaeldtaylor)\ **Replies:** 0\ **Last updated:** [May 5, 2017, 11:12am UTC](https://discuss.elastic.co/t/cluster-health-3-unassigned-shards/84700 "2017-05-05T11:12:45Z")
I've had some problems with my cluster when I added a simple synonyms bundle and clicked update. Long story short it now looks more stable, but I have 3x unassigned shards across 2x indices: .security (1) my\_index (2… --- ## [Elasticsearch filtering by the size of a nested field that is an array](https://discuss.elastic.co/t/elasticsearch-filtering-by-the-size-of-a-nested-field-that-is-an-array/28915)
**Author:** [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\ **Replies:** 2\ **Last updated:** [September 11, 2015, 6:45am UTC](https://discuss.elastic.co/t/elasticsearch-filtering-by-the-size-of-a-nested-field-that-is-an-array/28915 "2015-09-11T06:45:18Z")
How can I filter documents that have a nested field which is an array and has more than N elements? For example: "oid": "oid:user:my\_user", "updated\_at": "2015-09-09T08:27:58.121216", "versions": \[ … --- ## [How to sort by distance in aggregation?](https://discuss.elastic.co/t/how-to-sort-by-distance-in-aggregation/257391)
**Author:** [@isma-el](https://discuss.elastic.co/u/isma-el)\ **Replies:** 0\ **Last updated:** [December 2, 2020, 4:47pm UTC](https://discuss.elastic.co/t/how-to-sort-by-distance-in-aggregation/257391 "2020-12-02T16:47:34Z")
Hello, is it possible to sort by geodistance in an aggregation ? I can't find a way to achieve this. I need aggregations to remove duplicates according to multiple terms, bu I need to sort the results by geodistance. … --- ## [Fleet Server won't start - certificate error](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 9:06am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617 "2021-06-03T09:06:51Z")
I've been running 7.12 with 10 test endpoints all operating in Fleet without any problem. After upgrading to 7.13, I'm trying to re-deploy to the test endpoints (after manually removing the previous agent on each endpoi… --- ## [Unable to start Kibana](https://discuss.elastic.co/t/unable-to-start-kibana/46093)
**Author:** [@boreal](https://discuss.elastic.co/u/boreal)\ **Replies:** 8\ **Last updated:** [April 2, 2016, 5:12pm UTC](https://discuss.elastic.co/t/unable-to-start-kibana/46093 "2016-04-02T17:12:29Z")
Hi, I have Kibana 4.4. Today, I installed most of the Kibana plugins from this site: https://github.com/elastic/kibana/wiki/Known-Plugins However, I have not been able to start Kibana since. I removed Timeline and San… --- ## [Server IPC version 9 cannot communicate with client version 4](https://discuss.elastic.co/t/server-ipc-version-9-cannot-communicate-with-client-version-4/37296)
**Author:** [@Benny](https://discuss.elastic.co/u/Benny)\ **Replies:** 3\ **Last updated:** [December 18, 2015, 1:15pm UTC](https://discuss.elastic.co/t/server-ipc-version-9-cannot-communicate-with-client-version-4/37296 "2015-12-18T13:15:12Z")
Hi, I'm elasticsearch beginner and trying snapshot to HDFS but repository was not created on CentOS6.7. env : Hadoop2.6.2, ES 1.7.2, OpenJDK 1.7\_80 1) bin/plugin install elasticsearch/elasticsearch-repository-hdfs/2.1.2 … --- ## [7.6.0 still attempting plaintext http](https://discuss.elastic.co/t/7-6-0-still-attempting-plaintext-http/221830)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 13, 2020, 5:25pm UTC](https://discuss.elastic.co/t/7-6-0-still-attempting-plaintext-http/221830 "2020-03-13T17:25:42Z")
Wondering about these log events on our elected master node: \[2020-03-03T08:46:57,125\]\[WARN \]\[o.e.x.s.t.n.SecurityNetty4HttpServerTransport\] \[es-mst2\] received plaintext http traffic on an https channel, closing connect… --- ## [Create geopoint data](https://discuss.elastic.co/t/create-geopoint-data/107580)
**Author:** [@Rym\_Guerbi\_Michaut](https://discuss.elastic.co/u/Rym_Guerbi_Michaut)\ **Replies:** 4\ **Last updated:** [November 15, 2017, 12:54pm UTC](https://discuss.elastic.co/t/create-geopoint-data/107580 "2017-11-15T12:54:41Z")
Hi there, I want to create a beautiful visualisation of some geopoints on a map. I have a small view of 5 points in a relational database and I'm trying to put a correct code in Logstash filter to import the right dat… --- ## [Too\_many\_buckets\_exception after patching to 7.x](https://discuss.elastic.co/t/too-many-buckets-exception-after-patching-to-7-x/204409)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 3\ **Last updated:** [October 21, 2019, 11:14am UTC](https://discuss.elastic.co/t/too-many-buckets-exception-after-patching-to-7-x/204409 "2019-10-21T11:14:46Z")
I'm getting this error in our some of our Grafana panels now after updating to 7.4 from 6.8: type:"too\_many\_buckets\_exception" reason:"Trying to create too many buckets. Must be less than or equal to: \[10000\] but was \[… --- ## [Timestamp - Filebeat](https://discuss.elastic.co/t/timestamp-filebeat/270900)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 4:34pm UTC](https://discuss.elastic.co/t/timestamp-filebeat/270900 "2021-04-27T16:34:26Z")
Hello everyone, Hope you are doing well! I am exploring the possibilities of log viewing through Kibana. I am using version 7.9.2 for ELK and filebeat as well. so I am sending logs through filebeat directly to Elasticse… --- ## [Metricbeat 6.x is not starting (Windows)](https://discuss.elastic.co/t/metricbeat-6-x-is-not-starting-windows/113784)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 7\ **Last updated:** [January 4, 2018, 8:33am UTC](https://discuss.elastic.co/t/metricbeat-6-x-is-not-starting-windows/113784 "2018-01-04T08:33:45Z")
Hi everyone, i already used Metricbeat for the windows perfmon plugin in version 6.0.0-alpha2 to collect metrics from websites. now i was trying to replace 6.0.0-alpha2 with the 6.0.1 or 6.1.1 version, but it won't sta… --- ## [Add Information to tooltip](https://discuss.elastic.co/t/add-information-to-tooltip/112909)
**Author:** [@Schizo](https://discuss.elastic.co/u/Schizo)\ **Replies:** 5\ **Last updated:** [January 6, 2018, 6:19pm UTC](https://discuss.elastic.co/t/add-information-to-tooltip/112909 "2018-01-06T18:19:29Z")
Hi, I'm using a Line Chart and need to add fields into the tooltip which isn't possible right now. So is eventually something wrong with my workflow? I see a peak in my chart and when I move over that datapoint, I get a … --- ## [0.20.0 - failed to get local cluster state](https://discuss.elastic.co/t/0-20-0-failed-to-get-local-cluster-state/9537)
**Author:** [@Kennedy\_Idialu](https://discuss.elastic.co/u/Kennedy_Idialu)\ **Replies:** 5\ **Last updated:** [November 3, 2012, 12:33am UTC](https://discuss.elastic.co/t/0-20-0-failed-to-get-local-cluster-state/9537 "2012-11-03T00:33:23Z")
Just getting started with ES. I tried to start a client and I am getting the below exception Nov 03, 2012 12:54:48 AM org.elasticsearch.plugins INFO: \[Boomslang\] loaded \[\], sites \[\] Nov 03, 2012 12:54:54 AM org.el… --- ## [Field expansion matches too many fields, limit: 1024, got: 1369 with filebeat-6.6.0 indexes](https://discuss.elastic.co/t/field-expansion-matches-too-many-fields-limit-1024-got-1369-with-filebeat-6-6-0-indexes/178720)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 2\ **Last updated:** [May 6, 2019, 2:40pm UTC](https://discuss.elastic.co/t/field-expansion-matches-too-many-fields-limit-1024-got-1369-with-filebeat-6-6-0-indexes/178720 "2019-05-06T14:40:02Z")
We're running elasticsearch 7.0 but are still importing data from some filebeat-6.6.0 systems though logstash. Running queries in kibana we see shard failures and elastic reports: Caused by: java.lang.IllegalArgumentEx… --- ## [Adding a new column to a data table from a calculation based on two different columns in the same row](https://discuss.elastic.co/t/adding-a-new-column-to-a-data-table-from-a-calculation-based-on-two-different-columns-in-the-same-row/202022)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 5\ **Last updated:** [October 3, 2019, 5:04pm UTC](https://discuss.elastic.co/t/adding-a-new-column-to-a-data-table-from-a-calculation-based-on-two-different-columns-in-the-same-row/202022 "2019-10-03T17:04:42Z")
I was wondering if it was possible to add a new column to a data table in a Visualize from a calculation based on two different columns in the same row Say I have two columns Calls A and Calls B I want to create a thir… --- ## [Elastic Ingest with multiple grok processors](https://discuss.elastic.co/t/elastic-ingest-with-multiple-grok-processors/70451)
**Author:** [@JamesFx](https://discuss.elastic.co/u/JamesFx)\ **Replies:** 6\ **Last updated:** [January 3, 2017, 6:54pm UTC](https://discuss.elastic.co/t/elastic-ingest-with-multiple-grok-processors/70451 "2017-01-03T18:54:01Z")
Happy New Year everyone! I am trying to configure an ingest pipeline and I want to apply grok to two distinct fields. I couldn't find a way to do this. Does anyone have a suggestion on how to accomplish this. Thank y… --- ## [How to process "Lat" & "Long" fields using default Logstash config and mapping to use in Kibana 4 tile map](https://discuss.elastic.co/t/how-to-process-lat-long-fields-using-default-logstash-config-and-mapping-to-use-in-kibana-4-tile-map/23398)
**Author:** [@Rodger\_Moore](https://discuss.elastic.co/u/Rodger_Moore)\ **Replies:** 7\ **Last updated:** [April 28, 2015, 7:42pm UTC](https://discuss.elastic.co/t/how-to-process-lat-long-fields-using-default-logstash-config-and-mapping-to-use-in-kibana-4-tile-map/23398 "2015-04-28T19:42:53Z")
Hi there! My question is fairly simple but I'm having trouble finding a solution. I have a csv file containing Lat and Lon coordinates in separate fields named "Latitude" and "Longitude". Most of the info I found … --- ## [Encrypt couple of my document fields](https://discuss.elastic.co/t/encrypt-couple-of-my-document-fields/38213)
**Author:** [@tpraizler](https://discuss.elastic.co/u/tpraizler)\ **Replies:** 6\ **Last updated:** [March 15, 2017, 5:56am UTC](https://discuss.elastic.co/t/encrypt-couple-of-my-document-fields/38213 "2017-03-15T05:56:43Z")
Hey, I am storing some sensitive information in elasticsearch, which I want to be stored encrypted. I don't plan to search on those fields, so elasticsearch will just store those fields for me. Is there a recommende… --- ## [Problem to start logstash : java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/problem-to-start-logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/151017)
**Author:** [@morihend](https://discuss.elastic.co/u/morihend)\ **Replies:** 2\ **Last updated:** [October 4, 2018, 1:02pm UTC](https://discuss.elastic.co/t/problem-to-start-logstash-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/151017 "2018-10-04T13:02:37Z")
Hello, I use windows logstash 6.4.0 version. My logstash service worked untill i install the input-jdbc plugin. Now, when i tape in my terminal window this : bin\\logstash.bat to start logstash i obtained this mistack … --- ## [Maximum size of reports?](https://discuss.elastic.co/t/maximum-size-of-reports/117536)
**Author:** [@Mike\_Dreyfus](https://discuss.elastic.co/u/Mike_Dreyfus)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 2:26pm UTC](https://discuss.elastic.co/t/maximum-size-of-reports/117536 "2018-01-30T14:26:33Z")
Hi, I seem to be having an issue while generating reports for large amounts of data. I wanted to confirm if I'm hitting some kind of max size or if this is some kind of configuration issue. Currently, I am trying to pul… --- ## [Kibana Log Rotation](https://discuss.elastic.co/t/kibana-log-rotation/139764)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 4\ **Last updated:** [August 2, 2018, 7:27pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764 "2018-08-02T19:27:45Z")
I have set logging.destin kibana.yml, but the log file grows rapidly to the point where in just a few weeks some text editors (e.g. Notepad++) can't open the file because its so big. Is there a way to rotate the log fil… --- ## [Shield not recognizing users file?](https://discuss.elastic.co/t/shield-not-recognizing-users-file/2601)
**Author:** [@slee](https://discuss.elastic.co/u/slee)\ **Replies:** 4\ **Last updated:** [June 17, 2015, 3:42pm UTC](https://discuss.elastic.co/t/shield-not-recognizing-users-file/2601 "2015-06-17T15:42:47Z")
Hello, I'm currently testing the Shield product in our dev environment. I'm running into a problem with the configuration. We want to eventually use the Active Directory settings but first I'm just setting up the local… --- ## [How does master election process takes place when multiple master eligible nodes are present?](https://discuss.elastic.co/t/how-does-master-election-process-takes-place-when-multiple-master-eligible-nodes-are-present/154431)
**Author:** [@nikhil.k](https://discuss.elastic.co/u/nikhil.k)\ **Replies:** 6\ **Last updated:** [October 31, 2018, 6:22am UTC](https://discuss.elastic.co/t/how-does-master-election-process-takes-place-when-multiple-master-eligible-nodes-are-present/154431 "2018-10-31T06:22:21Z")
Hi Everyone, Elasticsearch Version-5.4.3 I want to know how master election process takes place when multiple nodes are present? Suppose, there are 5 elasticsearch nodes (all are master eligible nodes) present in a cl… --- ## [Logstash install error](https://discuss.elastic.co/t/logstash-install-error/138455)
**Author:** [@zekeriya\_tavlasoglu](https://discuss.elastic.co/u/zekeriya_tavlasoglu)\ **Replies:** 3\ **Last updated:** [July 11, 2018, 3:17pm UTC](https://discuss.elastic.co/t/logstash-install-error/138455 "2018-07-11T15:17:22Z")
Hi, when i try to install logstash on ubuntu, i am getting the error : what is the problem? can you help me. thanks. Zekeriya. sudo apt-get update && sudo apt-get install logstash Get:1 http://security.ubuntu.com… --- ## [Recommended configuration for write once files](https://discuss.elastic.co/t/recommended-configuration-for-write-once-files/86782)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 8\ **Last updated:** [June 2, 2017, 7:19am UTC](https://discuss.elastic.co/t/recommended-configuration-for-write-once-files/86782 "2017-06-02T07:19:45Z")
Hi all, I am looking for the most efficient configuration for our use case. We have almost 2000 files to index each day coming from several directories. Each file needs to be read only once as it is never updated. … --- ## [How to change the content of message field](https://discuss.elastic.co/t/how-to-change-the-content-of-message-field/175510)
**Author:** [@savitaashture](https://discuss.elastic.co/u/savitaashture)\ **Replies:** 6\ **Last updated:** [April 5, 2019, 2:00pm UTC](https://discuss.elastic.co/t/how-to-change-the-content-of-message-field/175510 "2019-04-05T14:00:08Z")
Hi All, Input log content: {"time": "2019-04-03T23:35:17.751Z","stream":"stdout","log":"message content information\\n"} console output: { "@timestamp": "2019-04-05T04:21:57.239Z", "@metadata": { "beat": "filebeat"… --- ## [Template Problems](https://discuss.elastic.co/t/template-problems/86909)
**Author:** [@uschellh](https://discuss.elastic.co/u/uschellh)\ **Replies:** 6\ **Last updated:** [May 26, 2017, 9:24am UTC](https://discuss.elastic.co/t/template-problems/86909 "2017-05-26T09:24:25Z")
Hello there, we are playing arround with elasticsearch and logstash, and i want to change the index template for having more indexed at once: basically we need that in the template: curl -XPUT 'localhost:9200/OURINDEX/… --- ## [Grok Date and time format](https://discuss.elastic.co/t/grok-date-and-time-format/46816)
**Author:** [@Jpuch](https://discuss.elastic.co/u/Jpuch)\ **Replies:** 4\ **Last updated:** [April 11, 2016, 3:58pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816 "2016-04-11T15:58:30Z")
Hello, i have this king of log : Aug 14 00:00:01 10.33.2.254 date=2015-08-14,time=00: 03:01, ... I'm not interrested in the first date and time (Aug 14 00:00:01) but by the second one : ( date=2015-08-14 and time=00… --- ## [Send all the aggregations as text with Watcher](https://discuss.elastic.co/t/send-all-the-aggregations-as-text-with-watcher/70722)
**Author:** [@jonhatan\_ricardo\_rod](https://discuss.elastic.co/u/jonhatan_ricardo_rod)\ **Replies:** 3\ **Last updated:** [January 9, 2017, 9:25am UTC](https://discuss.elastic.co/t/send-all-the-aggregations-as-text-with-watcher/70722 "2017-01-09T09:25:46Z")
Hey there, I'm configuring right now Watcher to search in the access logs and see how many error is so far and send it to a slack account. Well, the problem that I have is because I can't know how many aggregations I w… --- ## [Date filter and time zone transition](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672)
**Author:** [@simonhoenscheid](https://discuss.elastic.co/u/simonhoenscheid)\ **Replies:** 1\ **Last updated:** [July 3, 2017, 5:50pm UTC](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672 "2017-07-03T17:50:57Z")
Hey there, I'm a bit confused how the date filter is working. I have a logstash config which is parsing cloudfront logs from an s3 input. which is working really nice. the timestamp in the logfile is UTC. So I adde… --- ## [Upstream prematurely closed connection while reading response header from upstream - ES/kibana](https://discuss.elastic.co/t/upstream-prematurely-closed-connection-while-reading-response-header-from-upstream-es-kibana/26246)
**Author:** [@shome\_dnal](https://discuss.elastic.co/u/shome_dnal)\ **Replies:** 1\ **Last updated:** [July 25, 2015, 2:24am UTC](https://discuss.elastic.co/t/upstream-prematurely-closed-connection-while-reading-response-header-from-upstream-es-kibana/26246 "2015-07-25T02:24:25Z")
hello all my setup is as such: nginx(\*:443) -\> kibana(127.0.0.1:5601) -\> elasticsearch (127.0.0.1:5106) using kibana with elasticsearch for anything under 3 days timestamp is perfect and it runs smoothly; though … --- ## [Elasticsearch service start failed](https://discuss.elastic.co/t/elasticsearch-service-start-failed/52314)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 5\ **Last updated:** [June 9, 2016, 12:30pm UTC](https://discuss.elastic.co/t/elasticsearch-service-start-failed/52314 "2016-06-09T12:30:10Z")
Hi All, I tried to start the elasticsearch service on command line(service start) which returned below error in log file- \[2016-06-09 15:46:04\] \[error\] \[ 6328\] Failed to start 'elasticsearch-service-x64' service \[2016-… --- ## [Import .log file in elasticsearch and Kibana](https://discuss.elastic.co/t/import-log-file-in-elasticsearch-and-kibana/156181)
**Author:** [@matthiashaefeli](https://discuss.elastic.co/u/matthiashaefeli)\ **Replies:** 3\ **Last updated:** [November 11, 2018, 7:11am UTC](https://discuss.elastic.co/t/import-log-file-in-elasticsearch-and-kibana/156181 "2018-11-11T07:11:37Z")
I have this .log file with JSON and it looks like this {"method":"GET","path":"/public/index","format":"html","controller":"public","action":"index","status":200,"duration":84.59,"view":33.7,"db":47.45,"ip":"127.0.0.1… --- ## [How to control the filebeat read file sequence](https://discuss.elastic.co/t/how-to-control-the-filebeat-read-file-sequence/43973)
**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\ **Replies:** 7\ **Last updated:** [April 26, 2016, 3:54pm UTC](https://discuss.elastic.co/t/how-to-control-the-filebeat-read-file-sequence/43973 "2016-04-26T15:54:14Z")
The was log is stored in the order, but the order of the filebeat is changed, as shown below: Time Message March 10th 2016, 11:43:41.721 \[16-2-3 0:01:04:356 CST\] 00000026 Sys… --- ## [Shards not being allocated according to "box\_type" setting in designated nodes of same type](https://discuss.elastic.co/t/shards-not-being-allocated-according-to-box-type-setting-in-designated-nodes-of-same-type/197723)
**Author:** [@viniciof](https://discuss.elastic.co/u/viniciof)\ **Replies:** 4\ **Last updated:** [September 2, 2019, 6:07pm UTC](https://discuss.elastic.co/t/shards-not-being-allocated-according-to-box-type-setting-in-designated-nodes-of-same-type/197723 "2019-09-02T18:07:19Z")
I have an index of around 4.1TB~ total size in a cluster of 12 nodes (9 DATA & INGEST, 3 DATA & MASTER) and all of them are set to "hot" category - we don't currently have any "warm" node in this cluster. The problem is… --- ## [Is there Disk Limit on Warm/Hot Nodes](https://discuss.elastic.co/t/is-there-disk-limit-on-warm-hot-nodes/131852)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 5\ **Last updated:** [May 16, 2018, 1:34pm UTC](https://discuss.elastic.co/t/is-there-disk-limit-on-warm-hot-nodes/131852 "2018-05-16T13:34:23Z")
Hi All, We are running Hot/Warm nodes for time series data. Hot Nodes are on SSD and Warm are on Spinning disks both with 64GB Ram where 30G is allocated as ES heap size. ES version is 5.6.x. Is there any limit of data … --- ## [ES query on raw subfield](https://discuss.elastic.co/t/es-query-on-raw-subfield/63494)
**Author:** [@valerioorfano](https://discuss.elastic.co/u/valerioorfano)\ **Replies:** 8\ **Last updated:** [October 27, 2016, 10:33am UTC](https://discuss.elastic.co/t/es-query-on-raw-subfield/63494 "2016-10-27T10:33:07Z")
Hi there, I m struggling with raw not\_analyzed subfield i ve the following conf PUT /mise/wo-patent-document/\_mapping { "wo-patent-document": { "properties": { "wo-patent-document"… [Previous page](https://discuss.elastic.co/top.md?page=395&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=397&per_page=50&period=all)