# Top **URL:** https://discuss.elastic.co/top.md?page=397&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 398 --- ## [Terms aggregation with order with Java High Level Rest Client fails](https://discuss.elastic.co/t/terms-aggregation-with-order-with-java-high-level-rest-client-fails/183452)
**Author:** [@Isarg](https://discuss.elastic.co/u/Isarg)\ **Replies:** 3\ **Last updated:** [May 31, 2019, 3:24am UTC](https://discuss.elastic.co/t/terms-aggregation-with-order-with-java-high-level-rest-client-fails/183452 "2019-05-31T03:24:01Z")
The elasticSearch version is 5.6.4 The following terms aggregation query works perfectly fine on my Kibana console GET zipkin:\*/\_search { "size": 0, "aggs": { "group\_by\_traceid": { "terms": { "fie… --- ## [Using Filebeat with Zeek (issue with configuration)](https://discuss.elastic.co/t/using-filebeat-with-zeek-issue-with-configuration/192540)
**Author:** [@michaelberg](https://discuss.elastic.co/u/michaelberg)\ **Replies:** 5\ **Last updated:** [August 29, 2019, 3:39am UTC](https://discuss.elastic.co/t/using-filebeat-with-zeek-issue-with-configuration/192540 "2019-08-29T03:39:44Z")
Good afternoon everyone! Having a bit of an issue here with configuration and I hoping someone can kick me in the right direction ... Software Running: Latest compiled version of Zeek on a Fedora 30 Server Filebeat 7… --- ## [How to use "nested" properties fields in query script](https://discuss.elastic.co/t/how-to-use-nested-properties-fields-in-query-script/214621)
**Author:** [@astfgl](https://discuss.elastic.co/u/astfgl)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 9:23am UTC](https://discuss.elastic.co/t/how-to-use-nested-properties-fields-in-query-script/214621 "2020-01-13T09:23:59Z")
Hi, I'm using Elasticsearch v6.5.0. my sample data: PUT index/pim\_catalog\_product/bbb\_2255444 { "id": "2838", "identifier": "bbb\_2255444", "created": "2019-12-05T11:34:36+00:00", "values": { "footwear\_size… --- ## [ELK x-pack No matching indices found: \[index\_not\_found\_exception\] no such index](https://discuss.elastic.co/t/elk-x-pack-no-matching-indices-found-index-not-found-exception-no-such-index/83508)
**Author:** [@JIELOGAN](https://discuss.elastic.co/u/JIELOGAN)\ **Replies:** 3\ **Last updated:** [May 22, 2017, 1:53pm UTC](https://discuss.elastic.co/t/elk-x-pack-no-matching-indices-found-index-not-found-exception-no-such-index/83508 "2017-05-22T13:53:12Z")
hi everyone recently,I used x-pack to install my ELK,i wanted to import my local log file and use kibana to get reporting，monitoring...how can i achieve this？ And i have a error about filebeat： No matching indices found:… --- ## [Elasticsearch 8.9.2 and 7.17.13 Security Update](https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [September 6, 2023, 10:30pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479 "2023-09-06T22:30:46Z")
Elasticsearch Insertion of sensitive information in audit logs (ESA-2023-12) Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was… --- ## [How about Sflow support](https://discuss.elastic.co/t/how-about-sflow-support/153222)
**Author:** [@charlesrg](https://discuss.elastic.co/u/charlesrg)\ **Replies:** 2\ **Last updated:** [October 25, 2018, 11:23am UTC](https://discuss.elastic.co/t/how-about-sflow-support/153222 "2018-10-25T11:23:26Z")
To get data straight from network devices PacketBeat could support SFLOW. It's open and some more info here: https://sflow.org/sFlowOverview.pdf This way I could configure our routers/switches to send flows straight to… --- ## [How to config the shard numbers when index created by logstash?](https://discuss.elastic.co/t/how-to-config-the-shard-numbers-when-index-created-by-logstash/109003)
**Author:** [@Sungkeun\_Lee](https://discuss.elastic.co/u/Sungkeun_Lee)\ **Replies:** 2\ **Last updated:** [November 28, 2017, 7:14am UTC](https://discuss.elastic.co/t/how-to-config-the-shard-numbers-when-index-created-by-logstash/109003 "2017-11-28T07:14:31Z")
Hi, I am using ELK for collecting log. Logstash create a index everyday. Default shard setting is 5, but I wish change that. How do I have to do? Please let me know. --- ## [Warning After Upgrading to 7.15.2](https://discuss.elastic.co/t/warning-after-upgrading-to-7-15-2/288927)
**Author:** [@Brandon\_Liles](https://discuss.elastic.co/u/Brandon_Liles)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 9:26pm UTC](https://discuss.elastic.co/t/warning-after-upgrading-to-7-15-2/288927 "2021-11-10T21:26:33Z")
After upgrading a test cluster to 7.15.2 I see this warning when running Kibana queries in Discover constantly: 299 Elasticsearch-7.15.2-93d5a7f6192e8a1a12e154a2b81bf6fa7309da0c "Camel case format name dateOptionalTime … --- ## [Filebeat - transport.go:125: SSL client failed to connect with: read tcp connection reset by peer](https://discuss.elastic.co/t/filebeat-transport-go-125-ssl-client-failed-to-connect-with-read-tcp-connection-reset-by-peer/44257)
**Author:** [@charannaik](https://discuss.elastic.co/u/charannaik)\ **Replies:** 6\ **Last updated:** [March 13, 2017, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-transport-go-125-ssl-client-failed-to-connect-with-read-tcp-connection-reset-by-peer/44257 "2017-03-13T13:00:19Z")
hi, i configured filebeat as instructed here https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7 (execpt that i did this on Red had server) however i ha… --- ## [Kibana not showing all the data](https://discuss.elastic.co/t/kibana-not-showing-all-the-data/34131)
**Author:** [@rabeetwaqar](https://discuss.elastic.co/u/rabeetwaqar)\ **Replies:** 4\ **Last updated:** [November 9, 2015, 2:07pm UTC](https://discuss.elastic.co/t/kibana-not-showing-all-the-data/34131 "2015-11-09T14:07:41Z")
Hi, I have found an issue when playing around with kibana. It is not showing all the data from elasticsearch. Total docs in ES : 177,062 Total docs in kibana : 176,818 (when clicking on discover tab) Kibana date fi… --- ## [How to monitor inodes using metricbeat?](https://discuss.elastic.co/t/how-to-monitor-inodes-using-metricbeat/263818)
**Author:** [@premierpsp](https://discuss.elastic.co/u/premierpsp)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 8:52pm UTC](https://discuss.elastic.co/t/how-to-monitor-inodes-using-metricbeat/263818 "2021-02-21T20:52:12Z")
Hi, is there any option to monitor linux inodes with metricbeat? Thank you --- ## [Unable to start Auditbeat on LXC container](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-lxc-container/119913)
**Author:** [@Luq](https://discuss.elastic.co/u/Luq)\ **Replies:** 8\ **Last updated:** [January 27, 2020, 9:08am UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-lxc-container/119913 "2020-01-27T09:08:43Z")
Hi, I've searched here but couldn't find a similar issue. I'm trying to run Auditbeat on CentOS 7 and it fails to start. Log only has this: "root@kibana1:~# cat /var/log/auditbeat/auditbeat 2018-02-15T06:23:21.005Z I… --- ## [Kibana Fails to start : FATAL { \[Error: ENOENT: no such file or directory](https://discuss.elastic.co/t/kibana-fails-to-start-fatal-error-enoent-no-such-file-or-directory/60807)
**Author:** [@dvkawa](https://discuss.elastic.co/u/dvkawa)\ **Replies:** 4\ **Last updated:** [September 20, 2016, 3:57am UTC](https://discuss.elastic.co/t/kibana-fails-to-start-fatal-error-enoent-no-such-file-or-directory/60807 "2016-09-20T03:57:16Z")
Hi, I have installed ELK stack on windows and for some reason after i stopped Kibana from command prompt, while trying to restart i see below errors and it doesn't start: FATAL { \[Error: ENOENT: no such file or direc… --- ## [Grokprasefailure Issue with hyphen in the log](https://discuss.elastic.co/t/grokprasefailure-issue-with-hyphen-in-the-log/63332)
**Author:** [@13koushik](https://discuss.elastic.co/u/13koushik)\ **Replies:** 6\ **Last updated:** [October 24, 2016, 2:28pm UTC](https://discuss.elastic.co/t/grokprasefailure-issue-with-hyphen-in-the-log/63332 "2016-10-24T14:28:18Z")
I am getting a grokparsefailure message for the below stated conf. I'm not getting the SeverityLevel. The problem for with the - ( hyphen ) in the log. NOTSPACE isn't working for me. I would appreciate any help. Input … --- ## [Null date field is epoch in painless](https://discuss.elastic.co/t/null-date-field-is-epoch-in-painless/138832)
**Author:** [@fredericogalvao](https://discuss.elastic.co/u/fredericogalvao)\ **Replies:** 2\ **Last updated:** [July 13, 2018, 7:05pm UTC](https://discuss.elastic.co/t/null-date-field-is-epoch-in-painless/138832 "2018-07-13T19:05:45Z")
I have an index with a mapping with a field like this: "some\_date\_field": { "type": "date" } and when that field has a value of null, through a painless script it comes as a DateTime representing the epoch (and some o… --- ## [Get "Objects in arrays are not well supported" with new schema in Kibana](https://discuss.elastic.co/t/get-objects-in-arrays-are-not-well-supported-with-new-schema-in-kibana/206905)
**Author:** [@Arab.Soheyl](https://discuss.elastic.co/u/Arab.Soheyl)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 3:16pm UTC](https://discuss.elastic.co/t/get-objects-in-arrays-are-not-well-supported-with-new-schema-in-kibana/206905 "2019-11-07T15:16:32Z")
I have a multi log type in my system. I want to aggregate this Log and index it into Elasticsearch. my final schema is below. { "id": 1, "name": 2, "history": \[ { "login": { … --- ## [String size limit in painless / keyword field?](https://discuss.elastic.co/t/string-size-limit-in-painless-keyword-field/108366)
**Author:** [@fhdz](https://discuss.elastic.co/u/fhdz)\ **Replies:** 1\ **Last updated:** [November 20, 2017, 2:13pm UTC](https://discuss.elastic.co/t/string-size-limit-in-painless-keyword-field/108366 "2017-11-20T14:13:19Z")
Hi there, I am trying to perform some deduplication and sorting using "aggs" and "sort" queries. My documents contain some strings of different lengths and some of those strings are supposed to be part of the key for th… --- ## [Indexes with FileBeat](https://discuss.elastic.co/t/indexes-with-filebeat/59873)
**Author:** [@Apurv\_Jain](https://discuss.elastic.co/u/Apurv_Jain)\ **Replies:** 7\ **Last updated:** [September 12, 2016, 9:15am UTC](https://discuss.elastic.co/t/indexes-with-filebeat/59873 "2016-09-12T09:15:56Z")
Hi, I am using file beat to transfer logs to elastic. Everything is working fine, the only issue is that filebeat adds date to the ES index, so if my index name is "Test", how filebeat creates it on ES is "Test-YYYY.MM.… --- ## [Fast populate index using elastic search](https://discuss.elastic.co/t/fast-populate-index-using-elastic-search/2244)
**Author:** [@jimmy2017](https://discuss.elastic.co/u/jimmy2017)\ **Replies:** 4\ **Last updated:** [June 10, 2015, 6:58am UTC](https://discuss.elastic.co/t/fast-populate-index-using-elastic-search/2244 "2015-06-10T06:58:02Z")
I am a beginner in symfony2 elastic search integration. Currently my set up is simple with 5 shards and 1 node ( just one simple ubuntu node) with symfony and elastic search installed and running. How can I make ind… --- ## [Filebeat to logstash using proxy\_url](https://discuss.elastic.co/t/filebeat-to-logstash-using-proxy-url/68159)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 5\ **Last updated:** [December 8, 2016, 4:27am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-using-proxy-url/68159 "2016-12-08T04:27:02Z")
Hi, Can somebody provide practical use case to use proxy\_url when connecting logstash using filbeat output.logstash plugin? br, Sunil --- ## [ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof/64518)
**Author:** [@Timothy](https://discuss.elastic.co/u/Timothy)\ **Replies:** 7\ **Last updated:** [November 10, 2016, 9:22am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof/64518 "2016-11-10T09:22:13Z")
After reinstall all components, now the logs are written into ES by logstash, but the error message still exists. Not sure if it is safe to ignore it. ----------------- EDIT ----------------------- Hi, I am running ve… --- ## [Setup-passwords from ansible script](https://discuss.elastic.co/t/setup-passwords-from-ansible-script/123515)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 3\ **Last updated:** [March 13, 2018, 12:40pm UTC](https://discuss.elastic.co/t/setup-passwords-from-ansible-script/123515 "2018-03-13T12:40:05Z")
Hey, I'd like to automate my cluster provisionning (ansible). I am stucked on the password setup. How can I set my elastic, kibana and logstash passwords from a script, without prompting? I don't want to use the setup-p… --- ## [Groking syslog, seem to be getting a match but still getting \_grokparsefailure](https://discuss.elastic.co/t/groking-syslog-seem-to-be-getting-a-match-but-still-getting--grokparsefailure/2685)
**Author:** [@bobthomson](https://discuss.elastic.co/u/bobthomson)\ **Replies:** 7\ **Last updated:** [June 16, 2015, 12:34pm UTC](https://discuss.elastic.co/t/groking-syslog-seem-to-be-getting-a-match-but-still-getting--grokparsefailure/2685 "2015-06-16T12:34:37Z")
I am trying to parse and store a lot of syslog data, currently RHEL syslog + log4j output from Spring apps (Constraint is it has to come via rsyslog for now). My input is : input { udp { port =\> 514 … --- ## [Kibana charts/dashboards not rendering on mobile](https://discuss.elastic.co/t/kibana-charts-dashboards-not-rendering-on-mobile/48614)
**Author:** [@Priyanka\_Raina](https://discuss.elastic.co/u/Priyanka_Raina)\ **Replies:** 3\ **Last updated:** [April 29, 2016, 1:45pm UTC](https://discuss.elastic.co/t/kibana-charts-dashboards-not-rendering-on-mobile/48614 "2016-04-29T13:45:35Z")
I'm new to ELK and was trying to view some existing Kibana charts and dashboards, on a mobile platform (android/iOS/windows). The charts are embedded within a web application but when accessed on mobile, only the place… --- ## [Request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)](https://discuss.elastic.co/t/request-canceled-while-waiting-for-connection-client-timeout-exceeded-while-awaiting-headers/204217)
**Author:** [@vrathore18](https://discuss.elastic.co/u/vrathore18)\ **Replies:** 0\ **Last updated:** [October 18, 2019, 11:41am UTC](https://discuss.elastic.co/t/request-canceled-while-waiting-for-connection-client-timeout-exceeded-while-awaiting-headers/204217 "2019-10-18T11:41:19Z")
I am using below code snippet apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config namespace: kube-system labels: k8s-app: filebeat data: filebeat.yml: |- filebeat.config: inputs: … --- ## [Unable to setup elasticsearch cluster](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-cluster/83544)
**Author:** [@Newbie111985](https://discuss.elastic.co/u/Newbie111985)\ **Replies:** 2\ **Last updated:** [April 28, 2017, 8:37am UTC](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-cluster/83544 "2017-04-28T08:37:42Z")
I am trying to setup elasticsearch cluster for production environment. I am using two different hosts. The config params on elasticsearch.yml are as follows: node1: cluster.name: my-cluster-1 node.name: node1 network.h… --- ## [Is there a way to convert an Elasticsearch query to its Lucene equivalent?](https://discuss.elastic.co/t/is-there-a-way-to-convert-an-elasticsearch-query-to-its-lucene-equivalent/77020)
**Author:** [@Kevin\_Bourne](https://discuss.elastic.co/u/Kevin_Bourne)\ **Replies:** 0\ **Last updated:** [March 1, 2017, 4:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-convert-an-elasticsearch-query-to-its-lucene-equivalent/77020 "2017-03-01T16:17:25Z")
I have an existing parser that will properly parse a Lucene query into the data objects I need. I would like to reuse this code if possible as opposed to writing a new parser. Is there a way to take an existing Elastic… --- ## [Change in Time In elasticsearch and Database](https://discuss.elastic.co/t/change-in-time-in-elasticsearch-and-database/338869)
**Author:** [@UshasMerrinGeorge](https://discuss.elastic.co/u/UshasMerrinGeorge)\ **Replies:** 3\ **Last updated:** [July 21, 2023, 8:01am UTC](https://discuss.elastic.co/t/change-in-time-in-elasticsearch-and-database/338869 "2023-07-21T08:01:04Z")
Hi all, I'm having trouble with data parsing from a database to Elasticsearch. The "downloaddate" field in the database has a value like "2023-07-12 17:30:17.000." When I print it in the terminal using stdout, it's co… --- ## [Kibana is stuck trying to create index pattern](https://discuss.elastic.co/t/kibana-is-stuck-trying-to-create-index-pattern/153047)
**Author:** [@Corissalea](https://discuss.elastic.co/u/Corissalea)\ **Replies:** 2\ **Last updated:** [October 19, 2018, 6:44pm UTC](https://discuss.elastic.co/t/kibana-is-stuck-trying-to-create-index-pattern/153047 "2018-10-19T18:44:37Z")
I have ingested a small sample of data (1000 rows) into elasticsearch with logstash. When I go to Kibana and try to create the index, Kibana seems stuck and is taking forever to create the index - previously such a sma… --- ## [Elastic 8.7\_\_enrollement-token\_\_"failed to establish trust with server "](https://discuss.elastic.co/t/elastic-8-7-enrollement-token-failed-to-establish-trust-with-server/330856)
**Author:** [@Julien069](https://discuss.elastic.co/u/Julien069)\ **Replies:** 6\ **Last updated:** [May 10, 2023, 12:06pm UTC](https://discuss.elastic.co/t/elastic-8-7-enrollement-token-failed-to-establish-trust-with-server/330856 "2023-05-10T12:06:09Z")
Hi , I have a kibana server and an elastic server with differents IP address . When I want to create a token for kibana with command : sudo bin/elasticsearch-create-enrollement-token -s kibana OR sudo bin/elasticse… --- ## [Migration from AWS CloudSearch](https://discuss.elastic.co/t/migration-from-aws-cloudsearch/131205)
**Author:** [@chrispappas](https://discuss.elastic.co/u/chrispappas)\ **Replies:** 2\ **Last updated:** [May 16, 2018, 3:10pm UTC](https://discuss.elastic.co/t/migration-from-aws-cloudsearch/131205 "2018-05-16T15:10:10Z")
My company is currently working on migration away from Amazon CloudSearch (ACS) to Elastic. ACS Domains are basically a single index, unlike ES which as I've learned can support virtually unlimited numbers of distinct i… --- ## [Query and sort inside nested object](https://discuss.elastic.co/t/query-and-sort-inside-nested-object/283404)
**Author:** [@Are](https://discuss.elastic.co/u/Are)\ **Replies:** 2\ **Last updated:** [September 6, 2021, 8:29am UTC](https://discuss.elastic.co/t/query-and-sort-inside-nested-object/283404 "2021-09-06T08:29:51Z")
Edit: see step-by-step and deeper explanation in post below. I am trying to sort my search results based on a field inside a nested object. Running ES 7.9. The mapping of the nested object looks like this: { "metaDate… --- ## [Filtering by a aggregation (like SQL having clause)](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281)
**Author:** [@Lucas\_Porto](https://discuss.elastic.co/u/Lucas_Porto)\ **Replies:** 3\ **Last updated:** [October 8, 2018, 7:35pm UTC](https://discuss.elastic.co/t/filtering-by-a-aggregation-like-sql-having-clause/151281 "2018-10-08T19:35:40Z")
Hi all, My question is quite simple I think. I have the query below where I use two types of aggregations. The query works fine. GET /testeagg/\_search { "aggregations": { "group\_by\_id": { "aggregations": { … --- ## [Index Lifecycle Error - Not Write Index](https://discuss.elastic.co/t/index-lifecycle-error-not-write-index/207068)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 4\ **Last updated:** [November 18, 2019, 6:54am UTC](https://discuss.elastic.co/t/index-lifecycle-error-not-write-index/207068 "2019-11-18T06:54:39Z")
Hello guys, i tried to implement an ilm-policy. Now i always get the following error: illegal\_argument\_exception: source alias \[Syslog\] does not point to a write index Now, i don't really get how i make this inde… --- ## [Painless scripting field question](https://discuss.elastic.co/t/painless-scripting-field-question/93667)
**Author:** [@xwang12345](https://discuss.elastic.co/u/xwang12345)\ **Replies:** 4\ **Last updated:** [July 20, 2017, 7:03pm UTC](https://discuss.elastic.co/t/painless-scripting-field-question/93667 "2017-07-20T19:03:35Z")
I have a number of document, each document will have a src\_ip field. Some of the documents MIGHT also have a srcip\_host field. I would like to have scripted field, type is string(text), that takes the srcip\_host value … --- ## [Extract a substring from field](https://discuss.elastic.co/t/extract-a-substring-from-field/173336)
**Author:** [@Francesco\_Denardi](https://discuss.elastic.co/u/Francesco_Denardi)\ **Replies:** 3\ **Last updated:** [March 22, 2019, 1:45pm UTC](https://discuss.elastic.co/t/extract-a-substring-from-field/173336 "2019-03-22T13:45:08Z")
Hi, I would extract a substring from field for example I have this field @message type=USER\_AUTH msg=audit(155558731.704:1977444): pid=126 uid=0 auid=42949672915 ses=42945 msg='op=PAM:authentication grantors=pam\_uni… --- ## [Search for \[error\] in message content](https://discuss.elastic.co/t/search-for-error-in-message-content/224879)
**Author:** [@Tihomir\_Ilchev](https://discuss.elastic.co/u/Tihomir_Ilchev)\ **Replies:** 6\ **Last updated:** [April 2, 2020, 6:42am UTC](https://discuss.elastic.co/t/search-for-error-in-message-content/224879 "2020-04-02T06:42:45Z")
Hello, I am new in ELK and I am sorry if my question was already asked. I am facing issue by creating a query for displaying the messages which contain \[error\] (including the square brackets) string in the message part… --- ## [Radar - how to create the radar chart](https://discuss.elastic.co/t/radar-how-to-create-the-radar-chart/258728)
**Author:** [@gcastro](https://discuss.elastic.co/u/gcastro)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 2:53pm UTC](https://discuss.elastic.co/t/radar-how-to-create-the-radar-chart/258728 "2020-12-22T14:53:47Z")
Hello it seems you cannot do in native mode the radar graph in the new Kibana version. Has anyone managed to do it ? how ? thanks a lot for your replies regards gregory --- ## [Schema Migrations](https://discuss.elastic.co/t/schema-migrations/81108)
**Author:** [@sodiaan](https://discuss.elastic.co/u/sodiaan)\ **Replies:** 7\ **Last updated:** [April 4, 2017, 9:58am UTC](https://discuss.elastic.co/t/schema-migrations/81108 "2017-04-04T09:58:41Z")
When we write an application, we also write migrations for database schema and data, we use liquibase for that. What tools/library are using for migrations ElasticSearch schema? --- ## [Customizing colors in Kibana 4 widgets](https://discuss.elastic.co/t/customizing-colors-in-kibana-4-widgets/31506)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 8\ **Last updated:** [November 7, 2015, 3:47pm UTC](https://discuss.elastic.co/t/customizing-colors-in-kibana-4-widgets/31506 "2015-11-07T15:47:16Z")
We have a new requirement to highlight certain events in red to highlight them - is it possible to do that using the standard toolset?! Is customization of Kibana widgets possible - could you override the way certain t… --- ## [How to Send logstash logs directly to elastic?](https://discuss.elastic.co/t/how-to-send-logstash-logs-directly-to-elastic/126488)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 2\ **Last updated:** [April 3, 2018, 6:24am UTC](https://discuss.elastic.co/t/how-to-send-logstash-logs-directly-to-elastic/126488 "2018-04-03T06:24:30Z")
Hi all Can we send logstash logs directly to elastic?. Currently it sits under logs folder as physical .log files Is there any way we can do so? --- ## [Virtual Memory Issue](https://discuss.elastic.co/t/virtual-memory-issue/78247)
**Author:** [@dashwood](https://discuss.elastic.co/u/dashwood)\ **Replies:** 7\ **Last updated:** [March 13, 2017, 5:39am UTC](https://discuss.elastic.co/t/virtual-memory-issue/78247 "2017-03-13T05:39:30Z")
I've locked the memory with mlockall, changed it in systemd but Elasticsearch, and set the memorylock in elasticsearch.yml Yet somehow still manages to allocate 145 GB of virtual memory. Out of our physical 32 GB of ram,… --- ## [Moving data from SQL Server 2012 to ElasticSearch](https://discuss.elastic.co/t/moving-data-from-sql-server-2012-to-elasticsearch/70683)
**Author:** [@rrmave](https://discuss.elastic.co/u/rrmave)\ **Replies:** 7\ **Last updated:** [January 5, 2017, 4:06pm UTC](https://discuss.elastic.co/t/moving-data-from-sql-server-2012-to-elasticsearch/70683 "2017-01-05T16:06:33Z")
Hi, I am trying to move data from SQL Server to ElasticSearch. I am using the JDBC importer (http://xbib.org/repository/org/xbib/elasticsearch/importer/elasticsearch-jdbc/2.3.4.1/) and have written a batch script to pu… --- ## [Total.store.size\_in\_bytes measures what?](https://discuss.elastic.co/t/total-store-size-in-bytes-measures-what/15253)
**Author:** [@Ryan\_Pedela](https://discuss.elastic.co/u/Ryan_Pedela)\ **Replies:** 5\ **Last updated:** [January 20, 2014, 9:15am UTC](https://discuss.elastic.co/t/total-store-size-in-bytes-measures-what/15253 "2014-01-20T09:15:49Z")
What does "total.store.size\_in\_bytes" from the indices stats APImeasure? Disk space for the Lucene index? Disk space for the \_source data? Disk space for logs and other metadata? Does it count shards? Does it coun… --- ## [Adding new node to an existing Cluster](https://discuss.elastic.co/t/adding-new-node-to-an-existing-cluster/12110)
**Author:** [@Dina](https://discuss.elastic.co/u/Dina)\ **Replies:** 3\ **Last updated:** [May 24, 2013, 9:17pm UTC](https://discuss.elastic.co/t/adding-new-node-to-an-existing-cluster/12110 "2013-05-24T21:17:53Z")
Hello , I am new to ES , we already setup a node on a machine and starting importing data into it, now I want to add another node to this cluster by modifying this configuration on the existing node discovery.zen… --- ## [License update error](https://discuss.elastic.co/t/license-update-error/103308)
**Author:** [@nsivabalan](https://discuss.elastic.co/u/nsivabalan)\ **Replies:** 6\ **Last updated:** [October 10, 2017, 9:41am UTC](https://discuss.elastic.co/t/license-update-error/103308 "2017-10-10T09:41:57Z")
Hi Team, Getting below error while updating license. { "error": { "root\_cause": \[{ "type": "illegal\_argument\_exception", "reason": "failed to parse license source" }\], "type": "illegal\_argument\_exception", "reas… --- ## [Can't get logstash to work with Elastic 8.01](https://discuss.elastic.co/t/cant-get-logstash-to-work-with-elastic-8-01/298838)
**Author:** [@kim\_frederiksen](https://discuss.elastic.co/u/kim_frederiksen)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 6:37pm UTC](https://discuss.elastic.co/t/cant-get-logstash-to-work-with-elastic-8-01/298838 "2022-03-08T18:37:00Z")
Hi Everybody, I am extremely new to ELK and have yet to build the first real solution on the platform. We have had version 7.16.1 and we could see the logs from filebeat in kibana. But before we really begin building st… --- ## [Logstash with translate and external yaml file](https://discuss.elastic.co/t/logstash-with-translate-and-external-yaml-file/36182)
**Author:** [@l1carter](https://discuss.elastic.co/u/l1carter)\ **Replies:** 5\ **Last updated:** [December 2, 2015, 4:04pm UTC](https://discuss.elastic.co/t/logstash-with-translate-and-external-yaml-file/36182 "2015-12-02T16:04:37Z")
all, I've got a logstash.conf file I'm working with and it's using a translate function like so: translate { field =\> "hostname" destination =\> "devtype" dictionary\_path =\> "/opt/elk/logst… --- ## [Need to load balance Logstash](https://discuss.elastic.co/t/need-to-load-balance-logstash/275619)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 8\ **Last updated:** [June 13, 2021, 6:45am UTC](https://discuss.elastic.co/t/need-to-load-balance-logstash/275619 "2021-06-13T06:45:58Z")
I'm currently running a single logstash and interested in creating several for resilience in case one goes down, and for improving performance. I'm ingesting data currently with the http input plugin. I'm thinking about… --- ## [Logstash OSS features](https://discuss.elastic.co/t/logstash-oss-features/245347)
**Author:** [@sera](https://discuss.elastic.co/u/sera)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 2:59pm UTC](https://discuss.elastic.co/t/logstash-oss-features/245347 "2020-08-18T14:59:35Z")
What Logstash features are missing from Logstash OSS (latest versions)? Why is there no documentation describing the OSS vs Basic features? Thanks, Sera [Previous page](https://discuss.elastic.co/top.md?page=396&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=398&per_page=50&period=all)